ML22243A210
| ML22243A210 | |
| Person / Time | |
|---|---|
| Issue date: | 07/19/2022 |
| From: | Advisory Committee on Reactor Safeguards |
| To: | |
| Brown, C., ACRS | |
| References | |
| NRC-2041 | |
| Download: ML22243A210 (380) | |
Text
Official Transcript of Proceedings NUCLEAR REGULATORY COMMISSION
Title:
Advisory Committee on Reactor Safeguards SHINE Subcommittee Docket Number: (n/a)
Location: teleconference Date: Tuesday, July 19, 2022 Work Order No.: NRC-2041 Pages 1-226 NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers 1716 14th Street, N.W.
Washington, D.C. 20009 (202) 234-4433
1 1
2 3
4 DISCLAIMER 5
6 7 UNITED STATES NUCLEAR REGULATORY COMMISSIONS 8 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 9
10 11 The contents of this transcript of the 12 proceeding of the United States Nuclear Regulatory 13 Commission Advisory Committee on Reactor Safeguards, 14 as reported herein, is a record of the discussions 15 recorded at the meeting.
16 17 This transcript has not been reviewed, 18 corrected, and edited, and it may contain 19 inaccuracies.
20 21 22 23 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1323 RHODE ISLAND AVE., N.W.
(202) 234-4433 WASHINGTON, D.C. 20005-3701 www.nealrgross.com
1 1 UNITED STATES OF AMERICA 2 NUCLEAR REGULATORY COMMISSION 3 + + + + +
4 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 5 (ACRS) 6 + + + + +
7 SHINE SUBCOMMITTEE 8 + + + + +
9 TUESDAY 10 JULY 19, 2022 11 + + + + +
12 The Subcommittee met via Teleconference, 13 at 9:30 a.m. EDT, Ronald G. Ballinger, Chairman, 14 presiding.
15 16 COMMITTEE MEMBERS:
17 RONALD G. BALLINGER, Chairman 18 VICKI M. BIER, Member 19 CHARLES H. BROWN, JR. Member 20 VESNA B. DIMITRIJEVIC, Member 21 GREGORY H. HALNON, Member 22 JOSE MARCH-LEUBA, Chairman 23 DAVID A. PETTI, Member 24 JOY L. REMPE, Member 25 MATTHEW W. SUNSERI, Member NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
2 1 ACRS CONSULTANTS:
2 DENNIS BLEY 3 MYRON HECHT 4 STEPHEN SCHULTZ 5
6 DESIGNATED FEDERAL OFFICIAL:
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
3 1 C-O-N-T-E-N-T-S 2 Opening Remarks and Objectives . . . . . . . . . 4 3 Staff Opening Remarks . . . . . . . . . . . . . . 7 4 Design Criteria (SHINE) . . . . . . . . . . . . . 9 5 Design Criteria (NRC staff) . . . . . . . . . . . 23 6 Fire Protection (SHINE) . . . . . . . . . . . . . 38 7 Fire Protection (Staff) . . . . . . . . . . . . . 54 8 Instrumentation and Control 9 (Safety-Related Systems) (SHINE) . . . . . 83 10 Instrumentation and Control 11 (Safety-Related Systems) (Staff) . . . . 169 12 Public Comments . . . . . . . . . . . . . . . . 217 13 Adjourn 14 15 16 17 18 19 20 21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
4 1 P R O C E E D I N G S 2 9:30 a.m.
3 CHAIRMAN BALLINGER: Good morning. The 4 meeting will now come to order. This is a two-day 5 meeting of the SHINE Subcommittee of the Advisory 6 Committee on Reactor Safeguards. I'm Ron Ballinger, 7 Chairman of today's Subcommittee meeting.
8 ACRS members in attendance are Vicki Bier, 9 Charlie Brown, Greg Halnon, Jose March-Leuba, our 10 consultant Stephen Schultz, Matt Sunseri, Vesna 11 Dimitrijevic, and I'm sure there will be others that 12 will come on little bit later. Chairman Rempe will be 13 joining us in the afternoon.
14 During this meeting, the Subcommittee will 15 have a discussion with the NRC staff and SHINE Medical 16 Isotopes concerning the staff's evaluation report of 17 the following chapters: Chapter 3, Section 3.1, Design 18 Criteria; Chapter 9, Section 9a.3, Fire Protection; 19 Chapter 7, Instrumentation and Control, Safety-Related 20 Systems; Chapter 12, Section 12.10, Operator Training, 21 Requalification; Chapter 12, Section 7.9, Human 22 Factors Engineering; Chapter 12, Conduct of 23 Operations, Organization, Review and Audit Activities, 24 Procedures, Required Actions, Reports, Records, Etc.;
25 and Chapter 12, Section 12.11, Startup Plan.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
5 1 It's a lot of ground to cover. A part of 2 the presentations by the Applicant and the NRC may be 3 closed in order to discuss information that is 4 proprietary to the Licensee and its contractors 5 pursuant to 5 U.S.C. 552(d)(c)(4). Attendants at the 6 meeting that deals with such information will be 7 limited to the NRC staff and its consultants, SHINE, 8 and those individuals and organizations who have 9 entered into an appropriate confidentiality agreement 10 with them. Consequently, we need to confirm that we 11 have only eligible observers and participants in the 12 closed part of the meeting.
13 The rules for participating in all ACRS 14 meetings, including today's, were announced in the 15 Federal Register on June 13th, 2019. The ACRS section 16 of the U.S. NRC public website provides our charter, 17 bylaws, agendas, letter reports, and full transcripts 18 of all full and Subcommittee meetings, including 19 slides presented there. The meeting notice and agenda 20 for this meeting were posted there. We have received 21 no written statements.
22 There is an extremely loud background 23 noise, like somebody is vacuuming their couch. So, 24 whoever it is, can you -- good. You've finished 25 vacuuming.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
6 1 The meeting notice and agenda for this 2 meeting were posted there. We have received no 3 written statements or requests to make oral statement 4 from the public. The Subcommittee will gather 5 information, analyze relevant issues and facts, and 6 formulate proposed positions and actions as 7 appropriate for deliberation by the full Committee.
8 The rules for participation in today's meeting have 9 been announced as part of the notice of this meeting 10 previously published in the Federal Register.
11 Today's meeting is being held over 12 Microsoft Teams. A telephone bridge line allowing 13 participation of the public using their computer using 14 Teams or by phone was made available. Additionally, 15 we have made a MS Teams link available on the 16 published agenda. This will be the same link for 17 tomorrow's meeting.
18 A transcript of today's meeting is being 19 kept. Therefore, we request that meeting participants 20 on Teams and on the Teams call-in line identify 21 themselves when they speak and to speak with 22 sufficient clarity and volume that they can be readily 23 heard. Also, as the example just showed us, if you've 24 got loud background noise and things like that, it 25 hinders our operation. So, if you're not speaking, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
7 1 please mute yourself. The chat feature in Teams 2 should not be used for any technical exchanges.
3 At this time -- okay. I've already 4 covered that. Now I'll proceed with calling on Josh 5 Borromeo for opening remarks. Are you available?
6 Yep. He's there.
7 MR. BORROMEO: Yeah. Thank you, Professor 8 Ballinger.
9 My name is Josh Borromeo. I'm Chief of 10 the Nonpower Production and Utilization Facility 11 Licensing Branch. I first want to thank the ACRS and 12 the ACRS staff for their continued support on this 13 review. Professor Ballinger highlighted some of the 14 -- I'll call it the most anticipated sections of this 15 review, and today we'll be talking about the design 16 criteria, fire protection, and digital I&C related to 17 the safety-related systems. And tomorrow we'll be 18 talking about operator training and requalification, 19 human factors, conduct of operations, and the startup 20 plan.
21 Within these presentations, we'll be 22 addressing some of the follow-ups we had from last 23 meeting. In particular, there was some discussion 24 about the timing of certain components at the accident 25 analyses, and we'll be addressing those during the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
8 1 digital I&C review.
2 I think I said this at previous 3 Subcommittee meetings, but I do want to highlight 4 again the staff's support of the ACRS's process for 5 documenting concerns as we go through these 6 Subcommittees. We're finding that that's an efficient 7 way for us to understand what the concerns are and 8 address them in an efficient way at their Subcommittee 9 meetings.
10 I also want to emphasize that we 11 appreciate ACRS's timely review and insights during 12 this review, and we also appreciate the flexibility 13 ACRS is having with, in particular, me, but the NRC 14 staff as well, to get through this thing. I also want 15 to thank SHINE and the NRC staff for their 16 preparations in the development for slides and the SE 17 and the review for this meeting, and we look forward 18 to a good conversation with the ACRS today.
19 So, with that, I believe we're turning it 20 over to SHINE to discuss the design criteria.
21 CHAIRMAN BALLINGER: Thank you.
22 So, Tracy, are you all set to go?
23 MS. RADEL: Yeah.
24 MR. BROWN: Hey, Professor Ballinger?
25 CHAIRMAN BALLINGER: Yeah?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
9 1 (Simultaneous speaking.)
2 MS. RADEL: Yes. Ready to go here. Can 3 you hear me?
4 CHAIRMAN BALLINGER: Somebody else is 5 asking for -- we can hear you fine, Tracy, but there 6 was another comment.
7 MR. BROWN: Yeah. This is Chris Brown, 8 just letting you know that Member Petti has joined, 9 and I will be the DFO for this meeting.
10 CHAIRMAN BALLINGER: Oh. I'm sorry.
11 Okay. Good. I'm trying to keep an eye on this list 12 to see who joins and not. But that's great. Thanks.
13 Okay, Tracy.
14 MS. RADEL: Thanks.
15 Tracey Radel, SHINE's Vice President of 16 Engineering. I'm going to cover the design criteria 17 today. First, we're going to look at the development 18 of the SHINE safety criteria and what the SHINE safety 19 criteria is, and then go into the development of the 20 SHINE design criteria and cover the different design 21 criteria in the areas listed.
22 So the SHINE safety criteria is determined 23 for a definition and classification of safety -related 24 structure systems and components, which are those 25 physical SSCs whose intended functions are to prevent NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
10 1 accidents that could cause undue risk to the health 2 and safety of workers and the public, and to control 3 or mitigate consequences of such accidents.
4 We have defined acceptable risk as an 5 event being highly unlikely, less than or equal to ten 6 to the minus five per event per year, or having 7 consequences less severe than the SHINE safety 8 criteria. The SHINE safety criteria were developed 9 using NUREG-1537 and the ISG augmenting NUREG-1537, 10 10 CFR 70.61, 10 CFR 50.2, and the NRC proposed accident 11 dose criterion.
12 The SHINE safety criteria are listed here, 13 and as stated on the previous slide, acceptable risk 14 would be defined as highly unlikely or having a less 15 severe consequence than the items listed here. First, 16 we have an acute worker dose of five rem or greater 17 total effective dose equivalent, an acute dose of one 18 rem or greater TEDE to any individual located outside 19 the owner-controlled area, an intake of 30 milligrams 20 or greater of uranium in soluble form to an individual 21 located outside the owner-controlled area, an acute 22 chemical exposure to an individual from licensed 23 material or hazardous chemicals produced from licensed 24 material that could lead to irreversible or other 25 serious long-lasting health effects to the worker or NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
11 1 cause mild transient health effects to any individual 2 located outside the owner-controlled area.
3 Criticality, where fissionable material is used, 4 handled, or stored with the exception of the target 5 solution vessel or loss of capability to reach safe 6 shutdown conditions.
7 Are there any questions on the SHINE 8 safety criteria or its development before we move into 9 the design criteria?
10 Okay. Sorry about that. So, moving on to 11 the development of the SHINE design criteria, the 12 SHINE design criteria was developed based on 10 CFR 13 50, Appendix A, and 10 CFR 70.64(a), Design Criteria.
14 It's selected to cover the complete range 15 of facility operating conditions, responses to 16 anticipated transient and potential accidents, cover 17 safety-related SSCs, including redundancy, 18 environmental qualification, and seismic 19 qualification, inspection testing and maintenance of 20 safety-related SSCs, quality standards, and then 21 design features that prevent or mitigate consequences 22 for fire, explosion, meteorological, hydrological, and 23 seismic events.
24 As we go through the design criteria here, 25 the format I have is if our design criteria does not NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
12 1 differ from those listed in 10 CFR 50, Appendix A, or 2 the 10 CFR 70.64 in any way, I have not listed those 3 design criteria out explicitly. The design criteria 4 where there are slight differences between the SHINE 5 design criteria and those design criteria listed --
6 those are listed out, and I'll highlight just the 7 differences as we go through. Feel free to stop me at 8 any point if you have specific questions about the 9 differences that I highlight.
10 So, in Design Criterion 2, the difference 11 here is really in our facility structure is protecting 12 against tornadoes, hurricanes, floods, tsunamis, and 13 seiches. And so we distinguished that the facility 14 structure protects all of the safety-related 15 components from those events. And then the facility 16 structure, along with the safety-related SSCs, are 17 designed to withstand earthquakes. So we just 18 simplified that in our design criteria.
19 On the Criterion 4, the power plant 20 criteria focus on loss of cooling and ruptures of 21 systems containing high pressure and temperature.
22 With the SHINE systems at low temperature, pressure 23 with minimal stored energy, and no forced cooling for 24 safety, these do not pose a substantial risk. And so 25 the differences are reflected in our design criteria.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
13 1 For Criterion 5, again, the power plant 2 criterion is focused on cooldown, which is not 3 significant risk with the low decay heat and passive 4 light-water pool cooling in the SHINE systems. So 5 there's a simplification in our Design Criterion 5.
6 On Criterion 6, because no operator 7 actions are required in response to an accident, the 8 control room does not need to be occupied during 9 accident conditions, and that leads to a 10 simplification of Design Criterion 6.
11 Moving on to the subcritical assembly 12 design criteria, there are some substitutions that are 13 made for equivalent structures in the SHINE system, 14 SHINE design versus the power plant. And so I want to 15 highlight those replacement phrases.
16 For the 10 CFR 50, the reactor core and 17 associated coolant control and protection systems is 18 generally replaced with subcritical assembly system, 19 target solution vessel, offgas system, and primary 20 closed-loop cooling system. Fuel design limits are 21 replaced by target solution design limits, and 22 operational occurrences are replaced by anticipated 23 transients.
24 MEMBER HALNON: Hey, Tracy? Tracy, this 25 is Greg Halnon. Just real quick on the previous NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
14 1 slide, on number 6, I just wanted to make sure I heard 2 you right. There's no operator actions required for 3 accident response, but under 6, you do have the 4 control room -- last statement is perform required 5 actions under postulated accident conditions. Help me 6 just reconcile those statements.
7 MS. RADEL: Yeah. So the design criteria 8 were set prior to all the design and hazard analysis 9 being performed for the facility, and we did determine 10 that no operator actions were required to respond to 11 an event that does occur. And so -- you know.
12 MEMBER HALNON: Okay. Is it still, then, 13 part of the design criteria -- should something down 14 the road come up, like say a new accident situation or 15 some other transient that was not anticipated, is it 16 still part of the design criteria, or are you just 17 ignoring it at this point?
18 MS. RADEL: It is still part of the design 19 criteria. So, if something were determined to be 20 required in immediate response, we would make sure 21 that conditions are suitable for that. But at this 22 time, there are not any required to mitigate the 23 accident scenarios.
24 MEMBER HALNON: Thanks.
25 CHAIRMAN BALLINGER: This is Ron NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
15 1 Ballinger. I was going to wait until the end of your 2 presentation to ask this question, but this is a good 3 point, I guess. We have been reviewing chapters 4 before this for which there were oftentimes reference 5 to design criteria. But we hadn't reviewed the design 6 criteria at the time.
7 My question to you is, now that we have 8 the design criteria that we are reviewing, has the 9 connection between these design criteria in the 10 chapters that we previously reviewed where they 11 referenced the design criteria -- has that connection 12 changed in any way?
13 MS. RADEL: No. The connection has not 14 changed at all. The design there hasn't changed. So 15 just covering the design criteria in more detail based 16 on your requests to go into more detail on how they 17 are developed and what the details of them are.
18 CHAIRMAN BALLINGER: Okay. So we're 19 internally consistent?
20 MS. RADEL: Yes.
21 CHAIRMAN BALLINGER: Thank you.
22 MS. RADEL: Okay. On Criterion 10, the 23 reactor core and associated cooling systems has been 24 replaced by a subcritical assembly system. And on 25 Criterion 11, the phrasing is just slightly different, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
16 1 simplified because in the 10 CFR 50 language, it talks 2 about which can result in conditions, and then uses 3 the language of, are not possible. And so we 4 simplified that to, they can result, because we felt 5 if things are not possible, they don't fit into can 6 resolve. So just simplification of language there.
7 Okay. Criterion 12, the reactivity 8 control systems were replaced by target solution 9 vessel, offgas system, primary closed-loop cooling 10 system, and the TSV cell subsystem. The reactor 11 coolant pressure boundary was replaced by the primary 12 system boundary. The core was replaced by the TSV.
13 The capability to cool the core was replaced by 14 capability to drain the TSV.
15 And then the considerations, reactivity 16 accident considerations, were adjusted. So, in 17 reactor space, they listed rod ejection, rod dropout, 18 steam-line rupture, changes in reactor coolant 19 temperature and pressure, and cold water addition.
20 For our design criteria, based on our system design, 21 we listed excess target solution addition, changes in 22 primary cooling temperature, changes in primary system 23 pressure, and deflagration in the primary system 24 boundary.
25 I do want to point out for this design NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
17 1 criterion that earlier conversations related to 2 detonation being listed in our design criterion and a 3 question whether there would be a change to the 4 criterion, but the language here is that the accidents 5 would include consideration of detonation, and we have 6 considered detonation, although it's not possible in 7 the system, not credible.
8 On the instrumentation control and 9 protection system design criteria, there were no 10 changes beyond kind of minor wording changes that were 11 not of substance.
12 Moving into the primary system boundary 13 design criteria, the reactor coolant pressure 14 boundary, again, was replaced by primary system 15 boundary in Criterion 20. In Criterion 21, the 16 reactor coolant system and associated auxiliary 17 control and protection systems was replaced by the 18 primary closed-loop cooling system. And reactor 19 coolant pressure boundary, again, was replaced by 20 primary system pressure boundary.
21 On Criterion 25, the system to remove 22 residual heat was replaced by the light-water pool, 23 fuel design limits replaced by target solution design 24 limits. Reactor core was replaced by target solution 25 vessel dump tank, and the reactor coolant pressure NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
18 1 boundary replaced by primary system boundary.
2 Also note that the second paragraph in the 3 Criterion 34 from 10 CFR 50, Appendix A, was not 4 applicable to our system. It goes into the 5 reliability of electric power systems related to 6 maintaining active forced cooling requirements 7 assuming single failures.
8 Criterion 26, a system to transfer heat 9 from structured systems components as an ultimate heat 10 sink was replaced by the radioisotope process facility 11 cooling system and process chilled water system. Note 12 that in Criterion 44 in 10 CFR 50, Appendix A, it 13 lists the safety functions related to active heat 14 removal, whereas our secondary and tertiary cooling 15 systems do not provide any safety functions. So our 16 criterion just says they are provided to transfer 17 heat to the environment, which serves as the ultimate 18 heat sink.
19 Criterion 27 -- so, here, the criterion 17 20 within 10 CFR 50 is a very large -- I could not fit on 21 one slide. So the paragraphs that begin -- where the 22 beginning portion of the paragraph is listed and kind 23 of dot-dot-dot there, those are reflected in the SHINE 24 design criteria without any substantial changes.
25 The paragraphs that I have listed out NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
19 1 there in its entirety is a paragraph that is not 2 included in the SHINE design criteria and is related 3 to the transmission network, distribution system 4 failure, off-site power effects. And this is really 5 focused on loss-of-coolant accident, as you can see by 6 the final sentence in that paragraph. So we do not 7 feel that was applicable to the SHINE systems.
8 Criterion 29, getting into the confinement 9 and control of the radioactivity design criteria, the 10 reactor containment and associated systems was 11 replaced by confinement boundaries. Essentially, 12 leak-tight barrier was replaced by low-leakage 13 barrier. And containment design was replaced by 14 confinement design. In addition, we listed the four 15 classes of confinement boundaries in our design 16 criteria.
17 Criterion 30, the simplification here 18 really is related to the reactor criterion focusing on 19 the loss-of-coolant accident. So this goes into 20 detail about the different considerations for the 21 loss-of-coolant accident. Given that our forced 22 cooling system performs no safety function, and we 23 have passive cooling for the lower level of decay heat 24 within our systems, this is not applicable.
25 For Criterion 31, the portion of Criterion NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
20 1 51 from 10 CFR 50, Appendix A, that was included 2 directly is the surface temperature and other 3 conditions of containment boundary material during 4 operation maintenance, testing, and postulated 5 accidents. To ensure that there is not fracture was 6 included explicitly. The other ones were included in 7 the fact that you are ensuring that there is not a 8 fracture in that the postulated accident conditions.
9 MEMBER PETTI: So, Tracy, this is Dave 10 Petti. Could you go back? I'm just looking at those 11 two and wondering, which one is harder to meet in 12 practice in terms of the confinement boundaries? I'm 13 not too worried about fracture of some things, but 14 like leakages that end up being more excessive than 15 you think because of the accident condition would be 16 covered in 30, right?
17 MS. RADEL: Yes. Yeah. So the leakage at 18 the highest pressure scenario for accident conditions 19 is what our confinement safety function is based off 20 of.
21 MEMBER PETTI: All right. Okay. Thanks.
22 That helps.
23 MS. RADEL: Okay. Criterion 33 really is 24 a summary of multiple criteria listed in 10 CFR 50, 25 Appendix A, so piping systems penetrating containment, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
21 1 reactor coolant pressure boundary penetrating 2 containment, primary containment isolation, and closed 3 system isolation valves, the portions of which are 4 applicable to SHINE are included in our Design 5 Criterion 33, which states that piping systems 6 penetrating confinement boundaries that have the 7 potential for excessive leakage are provided with 8 isolation capabilities appropriate to the potential 9 for excessive leakage.
10 Piping systems that pass between 11 confinement boundaries are equipped with either a 12 locked closed manual isolation valve or an automatic 13 isolation valve that takes the position that provides 14 greater safety upon loss of actuating power. Manual 15 isolation valves are maintained locked shut for any 16 conditions requiring confinement boundary integrity.
17 This criterion really works in conjunction 18 with Criterion 34 as well. So this states that lines 19 from outside confinement that penetrate the primary 20 system boundary and are connected directly to the 21 primary system boundary are provided with redundant 22 isolation capabilities, ventilation monitoring, and 23 other systems that penetrate the primary process glove 24 box or hot cell confinement boundaries, are connected 25 directly to the confinement atmosphere and are not NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
22 1 normally locked closed, have redundant isolation 2 capabilities, or are otherwise directed to structures, 3 systems, and components capable of handling any 4 leakage.
5 Isolation valves outside confinement 6 boundaries are located as close to the confinement as 7 practical, and upon loss of actuating power, automatic 8 isolation valves are designed to take the position 9 that provides greater safety. Manual isolation valves 10 are maintained locked shut for any conditions 11 requiring confinement boundary integrity. And all 12 electrical connections from equipment external to the 13 confinement boundaries are sealed to minimize air 14 leakage. So, together, those two design criteria 15 really ensure that we maintain that low leakage.
16 Criterion 37 is related to criticality 17 control. Criticality in the facility is prevented by 18 physical systems or processes and the use of 19 administrative controls. Use of geometrically safe 20 configurations is preferred. Control of criticality 21 adheres to the double contingency principle, and a 22 criticality accident alarm system to detect and alert 23 facility personnel of an inadvertent criticality is 24 provided.
25 And finally, Design Criterion 39, which is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
23 1 a unique SHINE design criterion due to the risk of 2 hydrogen within the facility -- systems to control the 3 buildup of hydrogen that is released into the primary 4 system boundary and tanks or other volumes that 5 contain fission products and produce significant 6 quantities of hydrogen are provided to ensure that the 7 integrity of the system and confinement boundaries are 8 maintained.
9 Any questions on the SHINE design 10 criteria? All right. Thank you.
11 CHAIRMAN BALLINGER: Does that cover it, 12 Tracy?
13 MS. RADEL: Yep. That's the end of my 14 presentation.
15 CHAIRMAN BALLINGER: Okay. Questions from 16 the members? Let's see. I think we have new members 17 that are participating, Matt Sunseri and Dave Petti.
18 If I've missed somebody, please let me know.
19 Okay. So next up is the staff 20 presentations. I'm not -- oh, good. They're up.
21 Okay. So let's move forward. Thanks.
22 MR. HARDESTY: Can you see my slides and 23 hear me okay?
24 CHAIRMAN BALLINGER: I was about to panic.
25 No, you're right. We got them.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
24 1 MR. HARDESTY: All right. Great.
2 Good morning. It's a pleasure to speak 3 with all of you today. I am Duane Hardesty, a Senior 4 Project Manager in the Nonpower Production and 5 Utilization Facility Licensing Branch and the Office 6 of Nuclear Reactor Regulation. My presentation this 7 morning is on Chapter 3, SHINE Design Criteria.
8 Okay. The design criteria for a facility 9 establishes the criteria to provide reasonable 10 assurance that the facility can be operated without 11 undue risk to the health and safety of the public.
12 The design criteria should be specified for each 13 structure system and component and establish design, 14 fabrication, construction, testing, and performance 15 requirements for each SSC that is assumed in the FSAR 16 to perform an operational or safety function and 17 should also include references to applicable 18 standards, guides, and codes to support the design 19 functions as required by the safety analysis.
20 Section 50.34(b)(2) of the Code of Federal 21 Regulations requires a description and analysis of the 22 structures, systems, and components of the facility 23 with emphasis upon performance requirements, with 24 technical justification upon which these requirements 25 have been established, and the evaluations required to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
25 1 show that safety functions will be accomplished. The 2 regulation requires that the description be sufficient 3 to understanding of the system design and the 4 relationship to the safety evaluation.
5 Subparagraph Section 50.34(b)(4) of 10 CFR 6 requires a final analysis and evaluation design and 7 performance of the SCC with the objective of assessing 8 the risk to the public health and safety resulting 9 from the operation of the facility and including 10 determination of the margin of safety during normal 11 operation and transient conditions anticipated during 12 the life of the facility, and the adequacy of the SSCs 13 provided for the prevention of the accidents and 14 mitigation of the consequence of the accidents, 15 including consideration for any pertinent information 16 that has developed since the submittal of the 17 preliminary safety analysis.
18 Section 70.61 of 10 CFR provides 19 performance criteria related to the risk credible 20 events evaluated in the integrated safety analysis, 21 and the engineering controls, administrative controls, 22 or both that are applied to reduce the likelihood of 23 occurrence of the event. The additional Part 50 24 regulations require reasonable assurance that the 25 activities authorized by the operating license can be NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
26 1 conducted without endangering the health and safety of 2 the public and that the activities will be conducted 3 in compliance with the regulations and not be inimical 4 to the common defense and security.
5 The acceptance criteria used by the staff 6 to evaluate SHINE's design criteria is contained in 7 Part 1 and 2 of NUREG-1537 and the interim staff 8 guidance augmenting NUREG-1537 for licensing 9 radioisotope production facilities. In addition to 10 the base NUREG-1537 guidance, the ISG states that the 11 design must incorporate, to the extent practicable, a 12 preference for the selection of engineer controls over 13 administrative controls to increase overall system 14 reliability and features that enhance safety by 15 reducing challenges to the items relied on for safety.
16 The ISG also contains guidance that 17 addressing the radioisotope production facility design 18 criteria and defense-in-depth practices in 10 CFR 19 70.64 is an acceptable way of demonstrating adequate 20 safety of SSCs in the design of a facility. SHINE 21 based their chosen design criteria on Appendix A to 22 Part 50 and on 10 CFR 70.64(a) baseline design 23 criteria.
24 The NRC staff performed a review of the 25 technical information for the safety-related SSCs NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
27 1 presented in the SHINE FSAR to assess the sufficiency 2 of the design criteria as described in FSAR Section 3 3.1 to conduct the activities authorized by the 4 operating license. The NRC staff evaluated the 5 sufficiency of the design criteria using the guidance 6 and acceptance criteria from Section 3.1 of the design 7 criteria of NUREG-1537, Parts 1 and 2, and the ISG.
8 The NRC staff evaluated whether the design 9 criteria for the SHINE systems and subsystems are met 10 and if the FSAR describes how the principal design 11 criteria for the facility are achieved. The staff's 12 findings with regard to sufficiency of the SHINE 13 design criteria are documented in Chapter 3 of the 14 safety evaluation.
15 For each SSC, FSAR Table 3.11 and safety-16 related structure system components and Table 3.12, 17 non-safety-related structure system components, 18 identify the applicable FSAR section or sections that 19 describe each SSC. SHINE discusses the design 20 criteria for the individual SSCs and the applicable 21 FSAR section describing those SSCs. Similarly, the 22 NRC staff evaluation as applicable to those specific 23 design criteria is also included within a chapter of 24 the SE where the staff evaluated those SSCs.
25 The SHINE design criteria generally follow NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
28 1 Appendix A to Part 50, General Design Criteria for 2 Nuclear Power Plants, and 10 CFR 70.64(a), Design 3 Criteria, as Tracy just discussed. However, Appendix 4 A provides guidance in establishing design criteria, 5 but not all the design criteria apply directly to the 6 SHINE design.
7 Additionally, as discussed in Chapter 7 of 8 the staff's SE -- and you'll hear more about later --
9 the application-specific action items in the NRC 10 topical report on the highly integrated protection 11 system platform are intended for a power reactor 12 application, and not all ASAIs are critical for 13 ensuring safety in SHINE's application of the HIPS 14 platform for the target solution vessel reactivity 15 protection system and the engineering safety features 16 actuation system.
17 SHINE's safety-related SSCs are intended 18 to prevent, control, or mitigate the consequences of 19 accidents that could cause undue risk to the health 20 and safety of the workers and the public to an 21 acceptable level. The SHINE nuclear safety criteria 22 are based on 10 CFR 70.61 performance requirements.
23 SHINE states that an acceptable level of risk is 24 achieved by ensuring that events are highly unlikely 25 or by reducing the consequences to less than the SHINE NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
29 1 safety design criteria -- or sorry, safety criteria.
2 The SHINE nuclear safety criteria 3 requires that each engineer or administrative control 4 be applied to the extent needed to reduce the 5 likelihood of a high or intermediate consequence 6 event, such that upon implementation of such controls, 7 the event is highly unlikely or its consequences are 8 less severe than the SHINE safety criteria. Also, 9 the risk of nuclear criticality accidents must be 10 limited by assuring that under normal and credible 11 abnormal conditions, all nuclear processes are 12 subcritical.
13 Each engineer or administrative control 14 necessary to comply with those requirements must be 15 designated as an item relied on for safety, IROFS, and 16 the safety program must ensure that each item relied 17 on for safety will be available and reliable to 18 perform its intended function when needed and in the 19 context of the SHINE performance requirements.
20 SHINE selected radiological safety 21 criteria and consequence limits with dose limit values 22 that are lower than those specified in 10 CFR 70.61.
23 The SHINE total effective dose equivalent limits are 24 five rem for the workers and one rem for the public.
25 The NRC staff notes that the 10 CFR 70.61(c) doesn't NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
30 1 include a soluble uranium intake limit for 2 intermediate consequences. The limit is actually in 3 10 CFR 70.61(b), which means that the event leading to 4 an intake an excessive amount would actually be a high 5 consequence event. However, with SHINE's approach of 6 reducing the likelihood of both high and intermediate 7 consequence events to highly unlikely, the staff found 8 SHINE's use of soluble uranium intake limit to be 9 acceptable.
10 SHINE requires that criticality of safety 11 events be highly unlikely to have an acceptable risk.
12 To achieve this, SHINE requires that an item relied on 13 for safety must meet the double contingency principle 14 or be safe by design. Consistent with NUREG-1520, the 15 standard review plan for fuel cycle facilities, a 16 system of safety-related controls having the 17 appropriate reliability and availability qualities --
18 example described in sufficient detail so that their 19 effect on the overall likelihood can be evaluated --
20 will possess the double contingency protection and 21 meet the definition of highly unlikely.
22 SHINE also applies the safe-by-design 23 approach to passive design components. These include 24 items with the dimensions calculated to have a 25 favorable subcritical geometry with margin that have NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
31 1 no credible failure mechanism that could alter the 2 design (audio interference) management program. The 3 SHINE shutdown safety criteria ensures that the 4 facility is designed to automatically shut down the 5 irradiation process, place the target solution into a 6 safe condition, and stabilize accident conditions 7 without immediate operator action. The safety 8 criteria was reviewed and found acceptable by the NRC 9 staff in Chapter 13 of the staff's SE.
10 So SHINE talked about the 39 design 11 criteria that are listed in the FSAR for the main 12 production facility. Most of the design criteria have 13 specific application to individual SSCs, which are 14 listed in Table 311 and 312 in the FSAR. The NRC 15 staff's evaluation of the design criteria are provided 16 in the corresponding sections of its SE.
17 Eight of the criteria, however, are stated 18 to be generally applicable to the entire facility.
19 The staff evaluated the general design criteria as 20 applicable, and as an example, the adequacy for Design 21 Criterion 1 of the SHINE Quality Assurance Program was 22 reviewed and found acceptable in Section 7.4 and 12.9 23 of the SE. The NRC staff found that the SHINE QA 24 program is comprehensive and meets the regulatory 25 requirements of a QA program.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
32 1 Another example, Design Criteria Number 5, 2 the NRC staff evaluation found that the SSCs are 3 shared by both the irradiation facility and the 4 radiation production facility -- for example, all the 5 IUs share the ESFAS and the control room, but this 6 does not impair the ability to perform any safety 7 functions. The sharing of the SSCs was found 8 acceptable in Section 1.4 and in Section 7.4421 and 9 7.4521 of the staff's SE.
10 Finally, my last example is Design 11 Criteria 8. The NRC staff evaluated SHINE's emergency 12 plan and found SHINE emergency capability acceptable 13 in Section 12.47 of the SE. So, as was stated 14 earlier, the remaining 31 SHINE design criteria are 15 specifically assigned to systems and subsystems 16 detailed in the tables of the FSAR, and the NRC 17 staff's evaluations of those design criteria are 18 provided in the corresponding sections of the SE, many 19 of which will be discussed in presentations later 20 today.
21 The NRC staff finds that the application 22 of SHINE's design criteria discussed in the SHINE FSAR 23 Chapter 3 reflects the design features of the safety-24 related SSCs, which include redundancy, environmental 25 qualification, seismic qualification, and procedures NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
33 1 for inspection, testing, and maintenance that are 2 required to ensure and maintain safe facility shutdown 3 and prevent or mitigate the consequences of design-4 basis events.
5 The NRC staff reviewed the SHINE tech 6 specs and find that they provide appropriate safety 7 limits limiting safety system settings and limiting 8 conditions for operation of the facility pursuant to 9 10 CFR 50.36 technical specifications. Consistent 10 with NUREG-1537 Part 2 and the ISG to NUREG-1537 Part 11 2, the staff confirmed that the SCCs credited in the 12 accident analysis are designated as safety-related and 13 included within the tech specs.
14 Additionally, the NRC staff finds that the 15 tech specs include the necessary surveillance 16 requirements with the appropriate frequency and scope 17 to demonstrate the performance and operability of the 18 required systems. In the presentations that follow 19 today, the staff will discuss examples such as 20 instrumentation controls, fire protection, and startup 21 plans -- some of them will be tomorrow; I understand 22 that -- that show application of the design criteria 23 to the safe operation of the site facility.
24 In its evaluation, the NRC staff finds 25 that the SHINE design philosophy applied from the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
34 1 outset and through completion of the design is based 2 on providing successive levels of protection such that 3 health and safety are not wholly dependent upon any 4 single element of the design, construction, 5 maintenance, or operation of the facility.
6 SHINE's incorporation of defense-in-depth 7 practices results in a conservatively designed 8 facility and a system that will exhibit greater 9 tolerance to failures and (audio interference) final 10 design by focusing attention on the prevention and 11 mitigation of high-risk potential accidents to 12 decrease the likelihood of occurrence to highly 13 unlikely and/or reduce consequences to low.
14 Based on its evaluation, the NRC staff 15 concludes that the descriptions and discussions of 16 SHINE design criteria are sufficient and meet the 17 applicable regulatory requirements, guidance, and 18 acceptance criteria for the issuance of an operating 19 license. And that is the end of my presentation.
20 CHAIRMAN BALLINGER: Thank you.
21 Questions from the members?
22 MEMBER HALNON: Duane, this is Greg 23 Halnon. Criterion 5 on the sharing of systems -- we 24 had a comment earlier on about the tech spec system, 25 nitrogen gas. Do you have any comment on the sharing NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
35 1 of that system given the potential margin issues that 2 we talked about earlier?
3 CHAIRMAN BALLINGER: Are you talking about 4 the nitrogen purge system?
5 MEMBER HALNON: Yes. I think there was 12 6 bottles, and 11 are required, or something to that 7 effect.
8 MR. HARDESTY: Right. So we evaluated 9 that in the tech specs. It's not a proprietary number 10 to say that they require 16 standard cubic feet per 11 minute of flow for the nitrogen purge system. I 12 actually have a backup slide on hydrogen mitigation if 13 you'd like me to discuss it.
14 MEMBER HALNON: Yeah, just briefly. I 15 mean, we made a comment on it, and we wanted to make 16 sure that we understood the uses because I believe 17 that's shared across other systems as well, the gas 18 system.
19 MR. HARDESTY: It is. I'm sorry. I went 20 too far and lost the presentation. Okay. There we 21 go. So you should be able to see my hydrogen 22 mitigation slide.
23 MEMBER HALNON: Yes.
24 MR. HARDESTY: All right. So the TSV 25 offgas system maintains the TSV head space below the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
36 1 lower flammability limit by using air sweep gas and 2 via recombination. And that's the normal method. And 3 TOGS is purged to the process vessel vent system via 4 the vacuum transfer system. And so the process vessel 5 vent system has blowers that maintain a slight vacuum 6 across those RPF tanks to maintain hydrogen less than 7 the lower flammability limit.
8 The N2PS system, nitrogen purge system, is 9 a backup sweep gas flow from the nitrogen flasks. So 10 that only initiates upon a loss of power or a loss of 11 sweep gas flow that's sensed by the TRPS. The 12 solenoid valves, which de-energize to open, will 13 release the nitrogen purge gas to flow to the TSV dump 14 tank and the TOGS equipment, which is subsequently 15 discharged to the process vessel vent system. And 16 upon a loss of power or loss of a sweep gas flow to 17 the process vessel vent system, which would be sensed 18 by ESFAS, the radiological vent zone 2 is isolated, 19 and that nitrogen sweep gas flows through the process 20 vessel vent system piping.
21 So the normal system, TOGS, is part of the 22 pressure system boundary, and there's tech spec 23 limiting safety system setting and the required tech 24 spec 3.1.1, which is monitored by a tech spec required 25 a 3.2.3 TRPS set point. And the low process vessel NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
37 1 vent flow rate is also an LSSS with a tech spec 3.51 2 required system monitored by, again, a textbook 3.24 3 required ESFAS set point.
4 And the hydrate control in an operational 5 N2PS and nitrogen purge system are part of the tech 6 spec required definition for safe shutdown. And then, 7 of course, tech spec 3.8 requires that the system be 8 able to develop and deliver that 16 cf, standard cubic 9 feet per minute, flow rate in order to meet the design 10 criteria for the system.
11 MEMBER HALNON: Okay. So, given the 12 volume flow rate required, which was very small, and 13 then the volume of storage fill, there's adequate 14 margin for the sharing of the system.
15 MR. HARDESTY: Yes. That was the staff's 16 evaluation.
17 MEMBER HALNON: Thank you.
18 MR. HARDESTY: No problem.
19 CHAIRMAN BALLINGER: Other questions?
20 Okay. I'm trying to juggle two things here. We're 21 ahead of schedule. It's about 9:20. Fire protection 22 was next -- was supposed to be after break. I think 23 SHINE has -- well, the staff or SHINE; I forget which 24 -- has 11 slides, and I'm wondering whether we 25 shouldn't just keep on going. So I think that's what NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
38 1 I'll propose unless there's an objection from the 2 members.
3 So, if we're ready, can the SHINE folks 4 put up their fire protection slides?
5 MR. BARTELME: This is Jeff Bartelme from 6 SHINE. We've got some additional personnel coming 7 down to support, so we'll just need a minute or two.
8 We'll get the slides pulled up, and we should be ready 9 to present quickly.
10 CHAIRMAN BALLINGER: Okay. So should we 11 take a break, or should we wait just a minute or so?
12 MEMBER DIMITRIJEVIC: I say let's take a 13 break, Ron.
14 (Simultaneous speaking.)
15 MEMBER DIMITRIJEVIC: -- ten-minute break.
16 CHAIRMAN BALLINGER: Okay. Well, that 17 being the vote, we'll take a break. It's 10:22.
18 Let's come back at 10:30. How's that? So we'll break 19 until 10:30.
20 (Whereupon, the above-entitled matter went 21 off the record at 10:22 a.m. and resumed at 10:30 22 a.m.)
23 CHAIRMAN BALLINGER: Okay, it's 10:30, 24 we'll go back in session.
25 So, the SHINE presentation is up, so let's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
39 1 pick it up and start.
2 MR. MEYER: Hello, this is Andrew Meyer.
3 I'm the Safety Analysis Manager.
4 Next slide, please.
5 So, this is an outline of a presentation 6 regarding the fire protection program.
7 The objective of the fire protection 8 program is to minimize the probability and 9 consequences of fires in the SHINE facility.
10 Elements of the fire protection program, 11 work together to satisfy the requirements of 10 CFR 12 50.48 alpha.
13 The fire protection program takes a 14 defense-in-depth approach to prevent fires from 15 starting, including limiting combustible materials; 16 detect, control; and, extinguish fires which do occur, 17 to limit consequences.
18 Provide protection for systems, 19 structures, and components important to safety so that 20 a fire will not prevent the safe shut down of the 21 irradiation units, or cause an uncontrolled release of 22 radioactive material to the environment.
23 The diagram to the right shows how the 24 fire protection program and structure, relate to the 25 fire protection plan provided for in the FSAR.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
40 1 It includes the overall SHINE fire 2 protection program and the individual program 3 elements, including the lower tier documents such as 4 the fire hazard analysis; safe shut down analysis; 5 pre-fire plans; and, implementing procedures.
6 Specific details are provided in the lower 7 tier documents.
8 The fire hazard analysis establishes and 9 describes individual facility fire areas, which are 10 unique areas separated by fire radiant construction, 11 or administrative controls to prevent the spread of 12 fire between adjacent fire areas.
13 It determines the fire hazards posed by 14 operations and contents of each fire area. Hazards 15 included are combustible materials, and ignition 16 sources.
17 18 Along with the safe shutdown analysis, it 19 determines the worst case fire effects on safe 20 shutdown capability, and the potential for 21 uncontrolled release of radioactive materials.
22 It evaluates the efficacy of fire 23 protection features, such as fire prevention, 24 barriers, detection, suppression, and any need for 25 additional protection.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
41 1 The analysis is supported by a combustible 2 loading calculation quantifying the heat load and BTUs 3 per square foot; combustibles installed or stored in 4 each area; and, the radioactively controlled area.
5 Safe shutdown analysis demonstrates a 6 means of safe shutdown of the IUs to ensure they can 7 be placed and maintained in a safe and stable 8 condition, following a safe shutdown fire at any 9 facility fire area.
10 Also demonstrates the capability of safety 11 related equipment to prevent uncontrolled releases of 12 radioactive material, as a result of fire.
13 The performance goals of the safe shutdown 14 analysis are: radioactivity shall be maintained sub-15 critical in the event of a fire.
16 Combustible gas controls shall be capable 17 of performing their necessary functions in the event 18 of a fire.
19 Target solution cooling shall be capable 20 of removing heat, such that the target solution 21 boiling does not occur.
22 Uncontrolled release of radioactive 23 material shall be prevented. Equipment credited with 24 a safe shutdown function.
25 Moving components designed and credited to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
42 1 isolate areas containing radioactive materials, are 2 identified as part of the analysis.
3 The analysis is performed on a per fire 4 area basis. Redundant trains of safety related 5 equipment are demonstrated to be separated, such that 6 a single fire cannot impair safe shutdown function.
7 Primary separation criteria is fire 8 resistant barriers between the redundant trains. This 9 is redundant equipment located in different fire 10 areas.
11 Where redundant equipment is located in 12 the same fire area, the following separation criteria 13 are used in a fulmitative analysis.
14 Spatial separation distance of at least 20 15 feet where automatic fire suppression is provided, and 16 at least 40 feet where automatic fire suppression is 17 not provided.
18 Embedment of cable conduit and structural 19 concrete. Fixed wares suppression and/or detection in 20 the fire area.
21 Areas which have restricted access and/or 22 are sealed. Areas which are continuously occupied.
23 Administrative controls, and combustible loading.
24 Where these separation criteria cannot be 25 met by analysis, our modeling is performed to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
43 1 determine if both trains of equipment can be damaged 2 by a single fire.
3 Our fire modeling is a quantitative fire 4 modeling performed using the Consolidated Model of 5 Fire and Smoke Transport codes, to support the fire 6 hazard and analysis, and safe shutdown analysis.
7 Two scenarios of concern are modeled.
8 Fire involving a neutron driver high-voltage power 9 supply and nearby cables, and fire involving the 10 target solution vessel off-gas system motor control 11 centers.
12 With a high-voltage power supply fire 13 scenario, the objective was to determine if a fire 14 involving the HVPS could impact the structural members 15 of the building. Specifically the steel roof trusses, 16 and the steel bridge crane rails.
17 CFAST used to determine the hot layer gas 18 temperature, and temperatures of targets used to 19 represent the structural elements.
20 The sources of combustibles were 21 dielectric oil in the transformer, and cables in the 22 nearby cable trays.
23 The damage criteria was 593 degrees 24 Celsius. This is the critical temperature of steel.
25 The conclusion of the analysis was that NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
44 1 hot gas layer temperature at the target areas, is less 2 than the damage criteria. Specifically, less than the 3 critical temperature of steel.
4 CHAIRMAN BALLINGER: Now this is Ron 5 Ballinger. I have a question about that.
6 When you evaluated the high-voltage power 7 supply, did you folks evaluate what I would call arc 8 faults, that could, that may or may not happen that 9 would be source of a fire?
10 MS. RADEL: This is Tracy.
11 The source of the fire, I don't think was 12 evaluated in detail within the modeling. It was 13 assumed that it started on fire and the source of 14 combustibles was the oil within the transformer, and 15 the cable trays.
16 CHAIRMAN BALLINGER: I've see what can 17 happen when you're operating an accelerator and you 18 get an arc fault, and it's not a very pleasant 19 experience. So, it's something you might think about.
20 Maybe it's impossible with your (audio 21 interference.)
22 MS. RADEL: I think for the analysis it is 23 just assuming that it does start on fire. So, I don't 24 think it necessarily represents a more, you know, more 25 bonding case.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
45 1 But we will go to the team and talk to 2 them about the likelihood of, of that event.
3 CHAIRMAN BALLINGER: Thank you. Sometimes 4 these power supplies have a mind of their own.
5 MR. MEYER: For the TOGS MCC fire scenario, 6 the objective was to determine the distance, both 7 vertical and lateral, where critical temperatures are 8 exceeded to determine whether a single fire can impact 9 both TOGS MCCs.
10 The CFAST model was used to determine the 11 zone of influence for the TOGS MCC fire, and the 12 transient fires in the TOGS MCC hallway.
13 The sources of the combustibles in this 14 area were cables from the MCC and transient fires.
15 The damage criteria was 205 degrees Celsius, which is 16 based on the thermal damage criteria for thermoplastic 17 cables.
18 This bounds damage criteria for the bulk 19 cables, which critical temperature of 500 degrees 20 Celsius.
21 The completion of the analysis with the 22 critical temperatures of both division A MCC were not 23 reached by the fire, and division B MCC, and vice 24 versa.
25 And the cables in the raceways above the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
46 1 MCCs were not ignited.
2 The fire plans are developed for areas of 3 the main production facility to provide information 4 for trained facility personnel, and responding 5 professional fire fighters.
6 Plans include the following information as 7 appropriate. The area identification; forensic 8 contact information; the occupancy and processes; fire 9 hazards; radiation hazards; electrical information 10 including electrical disconnects; hazardous 11 substances; physical hazards; exposure protection 12 guidance; communications; access and egress routes; 13 ventilation; fixed fire systems; portable fire 14 fighting equipment.
15 (Pause.)
16 MR. BARTELME: This is Jeff Bartelme. Any 17 additional questions on the fire protection?
18 MEMBER HALNON: Yes, this is Greg Halnon.
19 I got a list of just kind of miscellaneous questions 20 I'd just like to have a conversation about, and work 21 through it.
22 It's not necessarily specific to your 23 presentation, but fire plan and a fire hazards 24 analysis.
25 First one, I realize, you know, we've NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
47 1 talked about this a little bit in the past where large 2 area fires were not required to be evaluated for the 3 regulation.
4 But you do have a aircraft impact in your 5 design basis, and you do a good job of establishing 6 the impact perspective, whether or not there's a 7 problem or not.
8 However, the ensuing consequences of 9 potential fire, given the fact that your structural 10 steel is not thermally protected, or fire protected.
11 And, that was part of the concern in the HVPS fire.
12 Have you thought through what that looks 13 like from a external perspective, with the potential 14 fuel catching on fire from an impact?
15 MS. RADEL: So, this is Tracy.
16 So the fire as a result of any aircraft 17 fuel on the exterior of the building, was not 18 specifically evaluated.
19 The SHINE structure, external structure, 20 is concrete with embedded rebar. There's not exposed 21 structural steel on the exterior of the safety related 22 portion of the building.
23 But it was not evaluated in detail on any, 24 any kind of effects on the concrete structure, other 25 than the, the impact itself.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
48 1 MEMBER HALNON: Okay. All right, that may 2 be something we can talk about a little bit more.
3 But we need to just kind of click down, 4 Tracy, through my questions and it's you or Andrew 5 probably can answer.
6 Is there going to be a dedicated fire 7 marshal either part-time, full-time or part-time?
8 MS. RADEL: No, there will not be.
9 MEMBER HALNON: Okay, so who's responsible 10 for maintaining the efficacy of the fire program?
11 MS. RADEL: Sorry, can you restate that a 12 little bit louder?
13 MEMBER HALNON: Yes. Who's responsible for 14 the fire program? Who's the assigned person who 15 makes sure that the fire program continues to be 16 complied with?
17 MS. RADEL: For the fire protection 18 program, that's owned by the safety analysis team.
19 MEMBER HALNON: Okay.
20 And, is there any, any fire specialist in 21 that team?
22 MS. RADEL: We --
23 (Simultaneous speaking.)
24 MEMBER HALNON: This is a big deal. Fire 25 is one of the things that, you know, can drive NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
49 1 radiation outside any facility.
2 So I'm really curious about how the fire 3 program is going to be maintained.
4 MS. RADEL: We utilize an outside 5 contracting group that has been involved throughout 6 the project on the development of the program, and 7 performance of the analyses.
8 We have been working to grow the SHINE 9 staff development in this area, through supporting 10 ongoing educational training in that area.
11 So, we feel that we, with the contract 12 firm, the vendor that has been involved throughout the 13 project and the effort to grow this capability, that 14 we have sufficient coverage.
15 MEMBER HALNON: Okay, well I think I hold 16 the opinion that if nobody is specifically assigned on 17 the staff, then nobody's going to specifically be that 18 concerned about it.
19 So, you might consider having at least a 20 part-time person that, just like a safety person, just 21 like you have a corrective action person, might 22 consider that.
23 The second, next question is, you do a 24 pretty decent job throughout the hazards analysis to 25 discuss how fire is confined to the cubicles. You NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
50 1 know, ventilation shuts down the, the dampers shut, 2 and that sort of stuff.
3 But how about re-entry. What are your 4 plans, and maybe this is a pre-fire plan issue, or 5 maybe it's just something you have to do ad hoc.
6 But what are the plans for re-entry? How 7 do you eject that smoke, and sample it, and make sure 8 that it's not radioactive, and passthrough filters and 9 what not? Especially in the RCA.
10 MS. KOLB: Yes, this is Catherine Kolb.
11 The recovery actions for fire is similar 12 to recovery actions for any emergencies, are covered 13 by our emergency plan.
14 We have not pre-prepared specific recovery 15 actions for that, but we have the capability in the 16 emergency plan, you know, dedicated people and a 17 process for developing recovery plans, and re-entry 18 provisions.
19 But we don't have anything specifically 20 prepared.
21 MEMBER HALNON: Okay. That might be again, 22 something you think through in the pre-fire plans 23 because eventually, you got to get back into these 24 places and, you know, assess the damage and what else, 25 so.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
51 1 All right, the next question is, has to do 2 with training. You pass along, I mean you have an 3 incipient fire brigade, or fire response, and then you 4 pass on to any fire fighting professional fire 5 fighters.
6 Given the hazards that are very unique at 7 this facility, how are you making sure that the 8 professional fire fighters from outside are protected, 9 one?
10 Two, are able to fight fires in 11 radiological areas; and, three, don't do the wrong 12 thing from the standpoint of putting water where it 13 shouldn't be, especially from a moderation 14 perspective?
15 MS. KOLB: Yes, this is Catherine again.
16 So we have been in discussions with the 17 Janesville fire departments in relation to the, our 18 emergency planning.
19 Per our plans, they will be offered 20 periodic tours, and orientation information, to allow 21 them to be familiar with the facility.
22 And, to have any kind of familiarization 23 orientation training on the various hazards of the 24 facility.
25 The pre-fire plans, as well as the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
52 1 emergency plan, will be provided to the fire 2 departments for their use, similar to other industrial 3 facilities in the city.
4 MEMBER HALNON: Okay, do you plan any real 5 time drills, or other types of things in your 6 facility, before you actually bring in radioactive 7 materials so that they can be familiar with the actual 8 cubicles, and ingress and egress passes, paths?
9 MS. KOLB: We are not required to have a 10 drill prior to receipt of the OL, but our emergency 11 plan has provisions, not just for fire but for all 12 emergencies, for drills and exercises.
13 Exercises to be conducted every two years 14 with invitation to the local emergency responders, 15 including the Janesville fire departments.
16 MEMBER HALNON: Okay, but there's no plan 17 on prior to the operation, to allow the, at least the 18 leadership of the fire department to walk through the 19 facility to be familiar with the, with the cubicles?
20 MS. KOLB: We don't have plans to do a full 21 blown exercise currently, but we do intend to, you 22 know, give them a tour, and offer information and 23 familiarization about the facility prior to the OL.
24 MEMBER HALNON: Okay. But it makes sense.
25 I mean certainly before you can, you know you have to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
53 1 put the symmetry on, it would be good to get them 2 through the facility.
3 Fire water storage. I know you used the 4 Janesville water system, and there's no fire water 5 storage on site.
6 Could you explain your reasoning for not 7 having at least the minimal amount of fire water 8 storage for potential outages, or freeze ups of the 9 water mains?
10 MS. RADEL: This is Tracy. In the testing 11 of that fire supply system, in the water supply 12 system, we ensured that there was sufficient flow and 13 pressure, for the duration needed.
14 I would need to go back and look at the 15 exact, exact detailed numbers on, on what was required 16 and demonstrated during that testing, for the fire 17 loop.
18 MEMBER HALNON: Okay, well yes, I didn't 19 have any question. I think I read through that and 20 saw that there was sufficient capacity. I'm just 21 consider the reliability of the water system.
22 I couldn't find any information online 23 about reliability, so I'm assuming that it's got a 24 high level reliability.
25 But it does get cold up there and I've NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
54 1 just, at least in my area, in Cleveland we seem to 2 have water main breaks all the time, which it may be 3 a much older system.
4 But I was just wondering if there was any 5 discussion relative to reliability of the water 6 system. I realize that when it's working, it's fine.
7 But what about when it's not working?
8 MS. RADEL: Yes, I would, we would need to 9 go back and check for reliability numbers on that.
10 MEMBER HALNON: Okay. At least we should 11 factor that into the analysis of summary.
12 I think this is the last question. It 13 talks about, and this may be a pre-fire plan and part 14 of that familiarization training.
15 But since you don't have any drains in the 16 RCA and you try to limit water in there, you talk in 17 the plan about having operations available to the 18 professional fire fighters to advise for when that 19 water could go in, and what not.
20 The professional fire fighters will 21 probably be in Scott Air-Paks, fully decked out. Will 22 you have the ability, how, explain to me how the 23 operations folks will communicate with the fire team 24 leaders, or fire brigade leaders, from the external 25 folks, to ensure that there's no water put one, in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
55 1 RCA, or where it shouldn't go from a moderation 2 perspective.
3 MS. KOLB: This is Catherine. Are you 4 commenting on the fact that they'll be in Scott Air-5 Paks and hard to talk to? Or I guess --
6 (Simultaneous speaking.)
7 MEMBER HALNON: Well --
8 MS. KOLB: -- could you elaborate a little 9 bit on the question?
10 MEMBER HALNON: -- that just makes the 11 communication more difficult.
12 I'm wondering how the operations folks 13 will communicate with the professional fire fighters 14 fighting a fire in the RCA on use of water, or use of 15 agents that might be inappropriate for, from a 16 radioactive perspective.
17 Or in the, I know that with no fire, with 18 no floor drains, that the use of water in there is not 19 expected.
20 But there is the statement in the fire 21 plan that says, operations will advise the 22 professional fire fighters about use of water to 23 ensure that the moderation, no moderation will occur 24 for, for fissile materials.
25 MS. KOLB: Okay, I understand. So the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
56 1 primary means of communication to the fire fighters 2 will be via the pre-fire plans, which they will have 3 access to and we will have available onsite.
4 I guess we don't expect them, fire 5 fighters, to come into the facility, you know, without 6 the knowledge of the operations team.
7 It is a, we have site security and they 8 would need to open the fence. So people would be 9 escorted at least up to the, up to the building and be 10 able to communicate with them prior to entering.
11 MEMBER HALNON: That's really --
12 (Simultaneous speaking.)
13 MS. RADEL: This is Tracy --
14 MEMBER HALNON: -- that's doesn't --
15 MS. RADEL: -- and in addition, the area 16 that is restricted from a fire spray perspective, is 17 a very small area of the facility.
18 And, we would ensure that that is very 19 clear to, to the fire department as far as that, that.
20 MEMBER HALNON: Okay.
21 I think you're making the case why the 22 professional fire fighters need to be very familiar 23 with the facility.
24 People at the facility, they need to be 25 drilled once in a while to make sure that those types NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
57 1 of communications occur. Because that's, as an ex-2 fire fighter myself, water is our primary agent.
3 But when we're going to do that, so we 4 need to make sure that those lines of communication.
5 And it's a crazy time when the, when a fire is 6 occurring. And, there's a lot of people descending on 7 it.
8 There's a lot of people chasing the soccer 9 ball, and just got to make sure that the team leaders 10 and the operations folks are connected up.
11 I think that is my last question so I'm 12 done.
13 Thanks.
14 CHAIRMAN BALLINGER: Steve Schultz, you had 15 your hand raised. Did you get your question answered?
16 I had mine answered by, by Greg, so --
17 (Simultaneous speaking.)
18 DR. SCHULTZ: Yes --
19 CHAIRMAN BALLINGER: -- do you still have 20 a question?
21 DR. SCHULTZ: No. The questions that Greg 22 asked were on my list, as well, especially associated 23 with the training, and the familiarization of the 24 professional fire fighters.
25 I don't think once every two years is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
58 1 going to be sufficient, to provide them with 2 sufficient information in case something does occur.
3 For all those reasons that Greg had 4 mentioned, that communication is very important and 5 the pre-fire, the pre-fire plans really have to be 6 taken very seriously with regard, with regard to that, 7 that piece.
8 CHAIRMAN BALLINGER: Good ideas. Are you 9 ready?
10 MEMBER DIMITRIJEVIC: Yes, this is Vesna 11 Dimitrijevic.
12 I have a couple questions about your safe 13 shutdown analysis.
14 So the bottom of the, my first question 15 is, what did your entering assumptions when you 16 analyzing the, you know, you are looking at the for 70 17 function activity combustible gas controlled cooling, 18 and preventing releases?
19 What are your entering assumptions? Do 20 you assume the operator will initiate the IU cell 21 safety actuation?
22 Is that your first assumption?
23 MS. RADEL: This is Tracy. We don't assume 24 that an IU safety cell actuation was initiated, prior 25 to the event occurring.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
59 1 You know, the safety system redundancy 2 provides protection such that if there is an outside 3 condition during that fire event, that the safety 4 system can sense it and take appropriate action.
5 So there's not operator action assumed at 6 the, at the onset of the event.
7 MEMBER DIMITRIJEVIC: So, how are you going 8 to dump the, the solution, you know? What would 9 actuate the valves?
10 MS. RADEL: So if the safety system senses 11 an unsafe condition, it will actuate the, the valves 12 and initiate shutdown of the unit.
13 MEMBER DIMITRIJEVIC: Wait, wait, wait.
14 What does it mean, if what non-safe conditions?
15 MS. RADEL: So the sensors within the, all 16 of the sensors and safety functions that we'll talk 17 about within the TSC reactivity protection system, and 18 the engineered safety feature actuation system, have 19 sufficient redundancy and separation such that at 20 least one train of instrumentation and control 21 function, safety functions, would be available to take 22 action automatically if there was an unsafe condition.
23 That is not to say that if there's a fire 24 in the facility, that we would not have operators 25 initiate shutdown to the units.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
60 1 It's just it's not relied on to, relied on 2 to mitigate the event.
3 MEMBER DIMITRIJEVIC: So it's not that 4 clear. What are the input for your activity 5 controller, that you assume that that will be 6 actuated?
7 MS. RADEL: If --
8 MEMBER DIMITRIJEVIC: I mean and also for 9 cooling, right? Your cooling relies on light water 10 pool, right?
11 (No audible response.)
12 MS. DIMITRIJEVIC: I mean that is why 13 function of the cooling, assume that the target 14 solution is dumped into the pool.
15 MS. RADEL: The target solution would be 16 dumped into the pool if one of the, one of the limits 17 was exceeded within the safety systems.
18 We do not have I guess, a system that 19 would be based on fire, automatically dump all of the 20 units.
21 It's looking at these, the safety 22 significant parameters within all of the systems and 23 taking the, the safety actuations if those unsafe 24 conditions do arise, concurrent with the fire.
25 So, in the safe shutdown analysis, we're NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
61 1 ensuring that with a fire in any part of the facility, 2 we have sufficient redundancy, and passive safety 3 within the systems, that we don't have an unsafe 4 condition that would violate one of those performance 5 goals that's listed on the screen.
6 MEMBER DIMITRIJEVIC: So basically what 7 you're telling me, and you can have a fire in any 8 facility, and as long as you have a cooling system 9 working, and you have, you know, so therefore, you 10 have offsite power, that, you know, the target 11 solution will be in the vessel?
12 MS. RADEL: So to clarify, offsite power is 13 not required. The units fail to a safe state, so on 14 any kind of power interruption, they will dump the 15 solution into the TSV dump tank, and it will be 16 passively cooled by the light water pool.
17 MEMBER DIMITRIJEVIC: Right, right, but I'm 18 interested the case you didn't lose the power by fire.
19 MS. RADEL: Okay, yes. If you do not lose 20 power and you've lost cooling flow, then the loss --
21 (Simultaneous speaking.)
22 MEMBER DIMITRIJEVIC: But you haven't lost 23 cooling and power, but you have a fire in some area 24 which may damage your, you know, the combustible gas 25 systems, things like that.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
62 1 What's happening the, but you have a power 2 in cooling, do you still have the, your target 3 solution --
4 (Simultaneous speaking.)
5 MS. RADEL: Yes, so --
6 MEMBER DIMITRIJEVIC: -- in the vessel.
7 MS. RADEL: -- so no matter what system the 8 fire is impacting, function of, if that, if it's a 9 system that's going to impact the safety of the unit, 10 it would, the impacts of that would be detected within 11 the IU cell, within the system itself.
12 It's looking at, as we'll discuss later, 13 it's looking at temperature of cooling waters, flow of 14 off-gas, you know, ability to recombine the hydrogen.
15 You know, all the neutron clocks.
16 If there are any unsafe conditions that 17 result from the fire, those will be detected, and the 18 appropriate safety actuation will occur due to the 19 redundancy in the system design, and the separation 20 between the redundant safety trains.
21 MEMBER DIMITRIJEVIC: Okay. I mean I have 22 to think now about the same scenario, just because I 23 was almost sure that you assume the operator would 24 initiate, the, the, you know, basically what is your 25 shutdown in this case.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
63 1 So, now I have to rethink all my, you 2 know, analyze it of this.
3 Let me ask you the other questions. You 4 didn't really do that, the (unintelligible) analysis 5 for like a spurious actuation?
6 MS. RADEL: Sorry, can you repeat the 7 question?
8 MEMBER DIMITRIJEVIC: You didn't do 9 (unintelligible) analysis, right? The analysis for 10 the spurious operation of the, you know, like --
11 (Simultaneous speaking.)
12 MS. RADEL: No, the analysis doesn't go 13 into spurious actuation, although it does assume a 14 single, single failure in addition to the fire event.
15 So, that could have been a spurious 16 actuation. But doesn't go beyond that, so we don't 17 evaluate multiple spurious actuations.
18 MEMBER DIMITRIJEVIC: So for example, the 19 one of your functions, you know, the prevent releases, 20 requires multiple components to move, right.
21 The dampers, the ventilation dampers, it 22 would make a (unintelligible) to move it a certain 23 position.
24 But you did not really analyze after they 25 move in that position, they can be spuriously open or NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
64 1 close, or whatever the safety position is by the fire.
2 MS. RADEL: To clarify, we did evaluate a 3 single failure in addition to the fire, which could 4 have been a spurious actuation.
5 So essentially, a damper or an isolation 6 valve failing to go to it's safe state. Due to the 7 redundancy in the system, however, there is always 8 the, the dual isolation, dual dampers.
9 You know, for, for the hydrogen 10 mitigation, it is parallel paths so that a single 11 failure would not result in an unsafe condition.
12 MEMBER DIMITRIJEVIC: All right, thanks.
13 CHAIRMAN BALLINGER: Other questions from 14 members? Or consultants, excuse me.
15 (No audible response.)
16 CHAIRMAN BALLINGER: Okay, hearing none, 17 can we shift over to the staff?
18 MR. BARTELME: Yes, good morning, this is 19 Jay Robinson, I'll be presenting. We'll give it a 20 second to get the slides up.
21 CHAIRMAN BALLINGER: I can see them fine.
22 MR. BARTELME: Okay, great. Good morning, 23 my name is Jay Robinson. I am one of the fire 24 protection reviewers, who conducted review of the 25 SHINE facility.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
65 1 The fire protection review was conducted 2 by the office of Nuclear Reactor Regulation, Division 3 of Risk Assessment, in the PRA licensing branch B.
4 Next slide, please.
5 Fire protection systems and programs.
6 Fire protection for nuclear facilities uses defense-7 in-depth, as SHINE talked about, to achieve the 8 required degree of safety by using administrative 9 controls, fire protection systems and features, and 10 post-fire safe shutdown capability.
11 Defense-in-depth is designed to present 12 fires from starting, detect, control, and extinguish 13 those fires that do occur.
14 And, to provide protection of SSC's 15 important safety, so that a continuing fire will not 16 prevent the safe shutdown of the plant.
17 Next slide.
18 The regulatory basis that's included in 10 19 CFR 50.48(a), fire protection. That requires a fire 20 protection plan that describes the fire protection 21 program, identifies positions responsible for the 22 program, and authorities delegated to those positions.
23 It outlines plans for fire protection, 24 fire detection and suppression capability, and 25 limitation of fire damage.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
66 1 Describes the administrative controls and 2 personnel requirements, for fire prevention and manual 3 fire suppression activities.
4 It describes automatic and manually 5 operated fire detection and suppression systems; and, 6 it describes the means to limit fire damage to SSCs 7 important to safety, to ensure safe shutdown.
8 Next slide, please.
9 Your regulatory basis also includes 10 criterion three of appendix A, to 10 CFR Part 50, in 11 that SSCs important to safety shall be designed and 12 located to minimize the probability and effects of 13 fire and explosions.
14 Non-combustible and heat resistant 15 materials shall be used whenever practical. Fire 16 detection and fighting systems of appropriate capacity 17 and capability, shall be provided and designed to 18 minimize adverse effects of fires on SSCs important to 19 safety.
20 And, fire fighting systems shall be 21 designed to ensure that there their rupture or 22 inadvertent operation, does not significantly impair 23 the safety capability of those SSCs.
24 Next slide.
25 The acceptance criteria we used was in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
67 1 NUREG-1537 Parts 1 and 2. There is the ISG also for 2 NUREG-1537, but the ISG did not have any applicable 3 parts related to fire protection.
4 The NUREG has to, states that the fire 5 protection plan needs to discuss the prevention of 6 fires, including limiting the types of, and types and 7 quantities of combustible materials, and needs to 8 discuss the methods to detect, control, and extinguish 9 fires.
10 And, it needs to discuss that the facility 11 should be designed, and protective systems should 12 exist, to ensure a safe shutdown and prevent the 13 uncontrolled release of radioactive material, if a 14 fire should occur.
15 Next slide, please.
16 Acceptance criteria also includes that the 17 SAR should contain sufficient information to support 18 the following, the conclusions listed below.
19 That the facility meets local and national 20 fire and building codes; the fire protection systems 21 can function as described; and, limit drainage and 22 consequences at any time.
23 That there is reasonable assurance that 24 training for fire protection is adequately planned; 25 that the potential radiological consequences of a fire NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
68 1 will not prevent safe shutdown.
2 And, any fire related release of 3 radioactive material to the unrestricted environment 4 has been adequately addressed.
5 That release of radioactive material from 6 fire would not cause radiation exposures that exceed 7 10 CFR Part 20.
8 And, that fire protection technical 9 specialists have been developed, if that's applicable.
10 Next slide, please.
11 Our review process and evaluation included 12 review of the preliminary safety analysis report, and 13 also the safety evaluation for the construction 14 permit.
15 We also looked at the final safety 16 analysis report, that was submitted with the 17 application. We also looked at additional licensee 18 supporting documents. They're listed below. I think 19 you all familiar with them.
20 The fire protection program; the fire 21 hazard analysis; safe shutdown analysis; combustible 22 loading calculation; fire modeling.
23 Draft procedures for combustible controls, 24 et cetera. The pre-fire plans, and radiological dose 25 consequences.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
69 1 Next slide, please.
2 During our review we developed about I 3 think 10 requests for additional information. Ten, 4 they all had some sub-parts to them.
5 The licensee responded to those requests 6 and provided additional information. Some of the 7 notable clarifications included fire brigade, and 8 manual fire fighting capability.
9 Operator actions, the fire protection 10 change control process; construction elements; safe 11 shutdown analysis.
12 The administrative controls; the codes of 13 record; code deviations; and, also radiological 14 consequences.
15 Next slide, please.
16 Our evaluation findings. We found that 17 fire protection related SSCs and defense-in-depth 18 controls are designed, construction, and used 19 consistent with good engineering practice.
20 Which dictates that certain minimum 21 requirements be applied as designed and safety 22 considerations for any new nuclear material, process, 23 or facility.
24 We found that there's reasonable assurance 25 that the fire protection systems and programs are in NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
70 1 conformance with NUREG-1537 Parts 1 and 2.
2 Next slide, please.
3 (Audio interference) found that there's 4 reasonable assurance that the facility meets the 5 requirements of 10 CFR 50.48, Part A, and criterion 6 three of Appendix A, to 10 CFR Part 50.
7 And, we also found there's reasonable 8 assurance that a fire in any plant area, during any 9 operational mode in plant configuration, will not 10 prevent the plant from achieving safe shutdown and 11 maintaining a safe and stable condition.
12 And, will also not cause radiation 13 exposures that exceed the requirements of 10 CFR Part 14 20.
15 And, that concludes my presentation. If 16 anyone has any questions, please feel free to ask.
17 CHAIRMAN BALLINGER: This is Ron Ballinger.
18 Can you go back to slide number what is it, 4?
19 And, I'd like to pull, oops, did I blow 20 that regulatory basis? I'm looking at the 21 presentation that I had before.
22 It's the slide titled Regulatory Basis.
23 Okay, I'm going to pull the string a little bit more, 24 that Member Halnon was pulling.
25 It says that, boy, I'm, my presentation NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
71 1 that I'm looking at is pretty tough compared to the 2 one that I've seen.
3 It says, but anyway, 10 CFR 50.48 da da da 4 identifies positions responsible for the program, and 5 authorities delegated to those positions.
6 Member Halnon was asking questions related 7 to who's in charge of the fire protection program.
8 Basically, is there a fire marshal.
9 So from what we heard in response to his 10 questions, it's not clear to me that that criteria is 11 satisfied. But I'm probably misinterpreting 12 something.
13 So can you elaborate a little bit? Maybe 14 Member Halnon can enlighten me.
15 MR. BARTELME: Oh no, yes, I can, yes I 16 can.
17 So we asked a question about that. Just 18 bear with me for one second, I just, I had it right 19 here. I want to make sure I'm in the right.
20 They responded to that in a request for 21 additional information, where you describe the fire 22 protection organization and its responsibilities.
23 And, they outlined the responsibilities 24 for the safety analysis manager, the operations 25 manager, the maintenance manager, and fire protection NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
72 1 staff. And, also the fire response team.
2 So, in that response, they satisfied the 3 answer to our question to describe the organization 4 and how it functions, and the authorities, as well.
5 MEMBER HALNON: We were just told that 6 there is no fire protection staff, dedicated staff 7 though, so how did they respond to, to that?
8 MR. BARTELME: Hang on one second. This is 9 in a RAI response we got in December of 2020.
10 (Pause.)
11 MR. BARTELME: Okay, the fire, this is what 12 SHINE has stated. The fire protection staff is 13 comprised of engineering and operations personnel, 14 responsible, I'll slow down, responsible for the 15 performance of inspection, surveillance, accepting 16 and, acceptance and periodic testing, and 17 implementation of design changes as necessary, of fire 18 protection systems.
19 Specific responsibilities of the fire 20 protection staff include resolution of day-to-day fire 21 protection issues.
22 Periodic update to the fire protection 23 plan and sub-tier documents; conduct of fire 24 protection engineering analysis.
25 Conduct of fire related training; NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
73 1 performance of liaison activities with an offsite fire 2 fighting organizations.
3 Performance of period facility walk downs 4 to assess the compliance with housekeeping, 5 combustible loading, ignition control, and design 6 requirements regarding fire prevention.
7 Ensure facility compliance with fire 8 protection design and licensing commitments, 9 regulations, committed codes and standards, building 10 code requirements, and insurance requirements.
11 Review of plant design changes to provide 12 concurrence on fire protection aspects; and, reporting 13 and investigation of fire occurrence and fire related 14 losses.
15 CHAIRMAN BALLINGER: Yes, this is Ron 16 again. I mean what you're describing is the functions 17 of what amounts to a committee.
18 I'm ex-Navy, and I'm interested in if I 19 want to pick up the phone and call somebody who's 20 responsible, who do I call?
21 So, it's not a committee that I want to 22 call, it's a person that I want to call.
23 Am I stating this right, Greg?
24 MEMBER HALNON: Well, that's the concern.
25 I mean, the amount of things he just read off were, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
74 1 you know, it's a full-time job almost.
2 But a lot of that can be spread amongst 3 the engineering processes and work control processes, 4 and people would affect it.
5 It really comes down to the importance 6 that we place on, on some of the programmatic aspects 7 of it, including the training, and pre-fire plans, and 8 what not.
9 It just feels uncentralized, or disbursed 10 to the point where it could possibly be an issue, at 11 least in my mind.
12 MS. RADEL: So this is Tracy. I do want to 13 clarify, you know, we had a engineer dedicated to fire 14 protection who recently left SHINE. We have a posting 15 currently up for fire protection engineer.
16 And, the safety analysis manager is 17 ultimately responsible for the fire protection 18 program.
19 But our intent is to hire a dedicated fire 20 protection engineer, to have their primary focus be on 21 the fire protection aspects.
22 But with recent staffing challenges, we 23 don't have that person currently on staff.
24 MEMBER HALNON: So Tracy, would that fire 25 protection engineer be the liaison with the offsite NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
75 1 folks as well, relative to the training and, and 2 maintaining pre-fire plans, and liaison with 3 operations, and making sure that the pre-fire plans 4 are appropriately up to date?
5 MS. RADEL: Yes, and that is the function 6 that the engineer that, that recently left SHINE did 7 perform, so.
8 MEMBER BIER: Can I have a quick follow up?
9 This is Vicki Bier.
10 I guess this is probably for Tracy, but 11 maybe also for staff. One other comment with regard 12 to fire protection responsibilities.
13 I think Tracy, you had mentioned that it, 14 the primary responsible person is the quote/unquote, 15 safety analysis manager.
16 But I'm also a little concerned that 17 safety analysis is very different from day-to-day 18 operational responsibilities, of making sure that fire 19 suppression equipment is operational and tested, and 20 all that kind of thing.
21 And, so, you know, there's, they obviously 22 both have safety in common, but I'm not sure that 23 safety analysis is, has the same operational focus.
24 MS. RADEL: Yes, as noted, the fire 25 protection engineer would have primary focus on it, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
76 1 you know, safety analysis manager, you know, being 2 that person's direct line manager.
3 But, you know, additionally, the people 4 within the operations team, as well as other people 5 within the engineering team, would also be involved 6 and aware, you know, made aware and trained, based on 7 what they need to know for performance of their 8 functions.
9 And, that fire protection engineer would, 10 would be, rely on to help ensure that appropriate 11 training is developed and I know some of that has 12 already, was already drafted by the previous fire 13 protection engineer.
14 CHAIRMAN BALLINGER: Yes, this is Ron 15 Ballinger again. I mean I think that what we're 16 trying to convey, at least what I'm trying to convey, 17 is that you know, fire protection, you better, you 18 hope you never have a fire and maybe you never do, or 19 that the frequency is so, so infrequent, that you get 20 to the point where you don't really think you need 21 one.
22 And, so things sort of decrease in 23 importance. Let's put it that way. But when you 24 actually have a fire, things change very radically, 25 all at once.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
77 1 So being conscious of maintaining 2 vigilance if you will, is important here.
3 MEMBER HALNON: So, yes, Tracy, this is 4 Greg.
5 I need to go back to the previous question 6 I asked. I asked if there is a full-time or a part-7 time fire marshal, and it was stated that there was a 8 contract out for contract staff, or contract work.
9 Now you're saying that there is going to 10 be a dedicated fire protection engineer, which by 11 default I guess the way you described it, has fire 12 marshal responsibilities.
13 So, could you go back and circle back and 14 make the record clear. Is there going to be a full-15 time or part-time fire, dedicated fire staff at, at 16 SHINE?
17 MS. RADEL: Yes. So the intent is to hire 18 a dedicated fire protection engineer that would, would 19 work within the safety analysis team.
20 The coverage that we have through our 21 contractors, who have been involved throughout the 22 entirety of the process, who have been the certified 23 fire protection engineer signing off on the program 24 and the calculations, and documents, will remain 25 engaged as well, to provide what we consider NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
78 1 sufficient coverage prior to us finding that staff 2 member.
3 And, longer term we intend to keep them 4 engaged.
5 The as far as fire marshal duties, a power 6 plant, having not worked at a power plant myself, I 7 don't know the exact duties and expectations of the 8 fire marshal.
9 On our, for our facility as I discussed 10 the, you know, the redundancy and isolation between 11 trains, as well as the failsafe states of the systems, 12 really, you know, ensures that the fire doesn't result 13 in exceeding the SHINE safety criteria.
14 So potentially, there's a difference in 15 level of risk between our facility, and a power plant.
16 And, Catherine, if you have other items having worked 17 at a power plant can speak to.
18 MS. KOLB: Sure. So some of the other 19 responsibilities of a fire marshal including, you 20 know, controlling transient combustibles, and 21 housekeeping walk downs, and making sure the, you 22 know, systems are functioning appropriately.
23 You know, depending on whether it is a 24 pre-planning kind of thing, we would expect that to be 25 assigned to the fire protection engineer.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
79 1 Or if it is, you know, a housekeeping walk 2 downs, and, you know, minimizing transient 3 combustibles, that would be the responsibility of the 4 operations.
5 The shift supervisor, and the people that 6 worked for them, you know, who do those kinds of walk 7 downs of grounds as part of their normal duties.
8 So I should note that the SHINE facility 9 is physically much smaller than a typical power 10 reactor.
11 So it's not inconceivable that, that, you 12 know, these duties, it's not, we don't see it as two 13 or three full-time people to be able to do this.
14 That if the fire protection engineer has 15 the primary responsibility for ensuring that the 16 program is met, that the in-plants and surrounded by 17 other duties, can just be accomplished by the regular 18 operating staff.
19 MEMBER HALNON: Thanks, I appreciate that.
20 I think that's appropriate. And, I don't think we 21 were pushing for a huge staff.
22 I think it's mainly is there going to be 23 an accountable person for the fire program as a whole, 24 beyond just a management person who's got plenty of 25 responsibilities already.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
80 1 So I think it's, you know, your discussion 2 about a dedicated fire protection engineer is 3 appropriate.
4 The fires in big facilities are usually 5 caused by welding work, or transformer failures, or 6 motor failures to that effect, and you're not exempt 7 from that there as well as the facility ages, and as 8 you do other work in the facility.
9 So, the size of the facility doesn't 10 matter, it just limits the amount of maybe potential 11 equipment that could fail. Or work that you might be 12 doing.
13 So, I think, you know, we probably talked 14 about this enough. I think you get our point. I 15 think you've satisfied at least myself, that there 16 will be a dedicated owner for the fire plans, and fire 17 programs.
18 I think that's just a real important 19 aspect of ongoing communications with the management 20 staff.
21 DR. SCHULTZ: Tracy, this is Steve Schultz.
22 I'll just take one more chance to having 23 my experience with emergency planning development for 24 nuclear power plants.
25 The emergency plan and the fire protection NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
81 1 plan, is probably the most important connection you're 2 going to have with the community.
3 And, to the extent you create a very firm 4 relationship with the fire department, to make sure 5 that they are really comfortable regarding the 6 operation and safety of the facility.
7 To the extent you do that, you will find 8 it extremely valuable in the future, in terms of your 9 facility operation.
10 If there is an incident at the facility 11 and the fire department is called, and whether it's a 12 big fire or just an emergency of even a medical 13 emergency, it's very important that when they get back 14 to the community, they will be able to let the 15 community know that they're very familiar with the 16 facility. They know how it operates, and so on and so 17 forth.
18 It's don't minimize the benefit you can 19 create if you do those things that Greg was talking 20 about.
21 Getting the fire department and 22 individuals in the facility early. Training them so 23 that they're very familiar with the operations so that 24 there's no question that when they need to come to the 25 facility, they'll have if you will, a good experience NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
82 1 and be able to help.
2 MS. RADEL: That's, thank you. I think 3 that's a very good point.
4 CHAIRMAN BALLINGER: Okay, other questions 5 by the members, or consultants?
6 (No audible response.)
7 CHAIRMAN BALLINGER: Okay, we're finishing 8 about a half an hour early. We're ready, chapter 7 is 9 next.
10 And, one of our members, we have arranged 11 this schedule so that we can accommodate the schedule 12 of all of our members. And, one of our members will 13 not be available until after lunch.
14 And, so what we're going to do is to 15 recess the meeting until 1:00 o'clock. So we'll just 16 have a bit longer, longer lunch.
17 So unless there are objections or 18 proposals for another way to do things, that's what 19 we'll do.
20 (No audible response.)
21 CHAIRMAN BALLINGER: Hearing none, we will 22 recess until 1:00 o'clock.
23 Thank you.
24 (Whereupon, the above-entitled matter went 25 off the record at 11:29 a.m. and resumed at 1:00 p.m.)
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
83 1 CHAIRMAN BALLINGER: Okay. It's 1:00 2 p.m., time to start up again. We have been joined, 3 and I'll probably miss somebody, by Member Rempe, 4 Chairman Rempe, and our consultant Dennis Bley.
5 If I have missed somebody I am sure I will 6 get reminded of it. In any case, we're going to do 7 pretty much Chapter 7 the rest of, most of the 8 afternoon anyway.
9 So we're all set. Is it Jason that's 10 going to do this?
11 MR. POTTORF: Yes. This is Jason Pottorf.
12 CHAIRMAN BALLINGER: Okay. All right, 13 we're ready to go, let's go.
14 MR. POTTORF: All right. Thank you. Yes, 15 again, this is Jason Pottorf, Director of Engineering 16 with Rock Creek Innovations.
17 Today I am going to do a quick 18 presentation about HIPS implementation for the TRPS 19 and the ESFAS.
20 I should point out that this presentation 21 is essentially the same as what was presented back in 22 February with some very minor modifications intended 23 to address some of the questions that were brought up 24 by Member Brown.
25 So I am going to quickly just skim through NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
84 1 most of the slides here and when I get to a section 2 where we made some changes I'll make sure and point 3 them out, but, yes, definitely stop me if you have any 4 questions anywhere.
5 MEMBER BROWN: Okay, I'll stop you now.
6 This is Charlie Brown. Please remind me of what stuff 7 you added based on my questions, if you would, if you 8 know what they are.
9 MR. POTTORF: If you go to I believe it's 10 Slide 4 or 5.
11 MEMBER BROWN: You don't have to go there 12 now. I'm just saying as you go through the 13 presentation you can tell me at that time.
14 MR. POTTORF: Okay. Okay, sounds good.
15 MEMBER BROWN: Do this in order.
16 MR. POTTORF: Yes. So we really have two 17 major sections of this presentation, those related to 18 the high-level architecture that was implemented for 19 the TRPS and ESFAS and then the specific platform 20 changes that were used in the implementation.
21 If you go to the next slide. One more.
22 And so really the main change here that was made is 23 these last three bullets on this slide here, and that 24 is to point out, you know, how we are implementing 25 diversity within the architecture.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
85 1 If you remember in the HIPS platform 2 topical we presented the representative architecture 3 which was essentially what is being implemented for 4 NuScale.
5 That architecture has four separation 6 groups or divisions of input to the system with two 7 divisions of actuation, and so the use of two diverse 8 FPGA types was sufficient to mitigate common cause 9 concerns in those four divisions.
10 But with the TRPS and ESFAS only having 11 three divisions that does not work and so we have 12 added a third FPGA type, and I've pointed out here 13 exactly what we are using there.
14 Two of those FPGAs are flash types, as 15 shown Division A has a Microsemi flash-type FPGA and 16 Division C also has a flash type but it is of a 17 different manufacturer.
18 So we do use the separate tools, the tool 19 suites that are used to perform the programming of the 20 device there. And then Division B uses the Xilinx 21 brand SRAM FPGA.
22 So that is really the main change that I 23 have made here to really point out how we are 24 addressing diversity for these systems with three 25 divisions. Any questions on that? If not, we can NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
86 1 move on.
2 DR. BLEY: Yes, I'm sorry, this is Dennis 3 Bley.
4 MR. POTTORF: Mm-hmm.
5 DR. BLEY: At some level you have defined 6 the logic that the rays have to carry out and at 7 whatever level that is, and you have used this special 8 language for it, that's a level at which you don't 9 have diversity, diversity comes after that.
10 And how have you ensured I'll call it the 11 perfection of that specification of the logic?
12 MR. POTTORF: I'm not sure I understand 13 the question. Could you repeat it?
14 DR. BLEY: You've given each of the 15 vendors something to build into their FPGA, a logic 16 structure, right?
17 MR. POTTORF: Yes. We use a model based 18 approach to develop the logic from which we will 19 generate hardware description language.
20 DR. BLEY: Stop. Stop right there.
21 MR. POTTORF: Mm-hmm.
22 DR. BLEY: At that point it's a common 23 specification before it becomes machine specific or 24 vendor specific. That's the point at which we don't 25 have diversity and my question was what techniques do NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
87 1 you use to make sure that that logic specification is 2 essentially perfect?
3 MR. POTTORF: So we do do simulation 4 testing of that logic prior to implementation into the 5 FPGA and the hardware and then we will also do similar 6 testing after implementation on the FPGA.
7 DR. BLEY: So a simulation testing for you 8 means giving a set of inputs like those that would 9 come from the plant to the logic and making sure it 10 generates what you want?
11 MR. POTTORF: Yes.
12 DR. BLEY: What process gives us very good 13 confidence that the set of simulations you have 14 decided to run is complete, that there is not a 15 somewhat different specification that will not make it 16 properly through the logic?
17 MR. POTTORF: We do look at coverage of 18 the logic in that testing to ensure that, you know, we 19 cover all of the logic that we have designed and also 20 that there is no, you know, test error logic in the 21 design that does not get exercised.
22 Then we will, you know, we use our 23 development life cycle that meets IEEE-7432 standard 24 guidance as well, so --
25 DR. BLEY: I am somehow not quite getting NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
88 1 there. I think we're close. When you did NuScale?
2 MR. POTTORF: So, yes, we have not 3 developed the logic for the specific NuScale 4 application yet.
5 DR. BLEY: Okay. But you have -- Okay, 6 let's talk about SHINE.
7 MR. POTTORF: Yes. We are working through 8 that process currently for SHINE.
9 DR. BLEY: They have given you a set of 10 inputs that you would simulate to cover all of the 11 accidents they are worried about as well as normal 12 operations?
13 MR. POTTORF: So SHINE provides us higher 14 level system requirements and we capture those in our 15 own system requirements spec that we can trace up to 16 SHINE's requirements for the system design and system 17 functions.
18 From there we will then, you know, 19 architect the system and allocate those requirements, 20 functional requirements, to the individual HIPS 21 components and then for each of those HIPS components 22 that do utilize an FPGA we will develop a separate 23 programmable logic requirement specification that gets 24 linked up to the higher level system requirements.
25 From there our development life cycle NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
89 1 includes generating a logic design model to implement 2 those individual programmable logic requirements and 3 from that model we will generate a programmable logic 4 design specification that, you know, captures a 5 description of that logic model and associated with 6 that logic model we will generate specific test plans, 7 test cases, and test procedures that will be 8 implemented for each FPGA separately.
9 So we essentially implement what would 10 look like your typical software development life 11 cycle. We do that for every individual FPGA. So 12 we'll do all the integration testing for the logic 13 components and then finish up the testing for that.
14 We do separate sets of testing prior to 15 implementation of that logic in the hardware and then 16 we'll do post-implementation testing of the hardware 17 as well.
18 DR. BLEY: Well I think this is coming 19 close. For the members on the Committee, you know, we 20 worry a lot about were there any gaps in the safety 21 analyses and risk assessments.
22 But that's assuming all this stuff works 23 right and down at the definition of logic stage I'm 24 not sure the Committee has ever taken a good look at 25 that.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
90 1 We might have some time ago on some older 2 projects. Charlie, I think we did a little bit of 3 that, but being comfortable with that seems like 4 something we ought to touch on.
5 MR. POTTORF: Yes. I will point out we 6 kind of split our life cycle out. You know, we go 7 down for each FPGA and we go through, you know, kind 8 of that full typical software development life cycle 9 at the FPGA level where we will, you know, identify 10 requirements, document the design, testing.
11 But then once we get through FPGA 12 development and implementation on each specific module 13 then we'll start to, we'll come back out to that 14 higher system level where we integrate each module 15 into separate chassis and cabinets and there we'll do 16 what would be your typical system integration type 17 testing that gets tied back up to the system level 18 requirements that come from SHINE.
19 DR. BLEY: Okay. Thank you.
20 MR. POTTORF: Mm-hmm.
21 MR. HECHT: This is Myron Hecht. Can I 22 follow up with a couple of questions?
23 MR. POTTORF: Sure.
24 MR. HECHT: Okay. So the 7432 standards 25 and the NRC standards, of course, they'll send you to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
91 1 the IEEE software development standards for the 2 software requirement spec and the design document and 3 the test and the requirements verification.
4 Is that I'll call it HDL development plan 5 described anywhere and has that been provided to the 6 Staff?
7 MR. POTTORF: Jeff, do you want to respond 8 on the status of providing that? Yes, we do document 9 our life cycle that we use.
10 We do have a programmable logic 11 development plan that we provide for each project as 12 well as a verification validation plan, configuration 13 management plan, all those things that you would 14 typically see required for the IEEE standards for 15 software development.
16 MR. BARTELME: So this Jeff Bartelme, 17 Director of Licensing at SHINE. Programmable logic 18 life cycle description is provided in the FSAR and we 19 are currently, we have provided a number, all but one 20 of the planning phase documents to the NRC Staff right 21 now via the NRC reading room as we prepare for an 22 upcoming NRC audit of the requirements phase for the 23 HIPS core logic.
24 So we've made a number, there is still one 25 outstanding document that we need to, we have to make NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
92 1 available, but we have made a number of the planning 2 phase documents available to the NRC Staff.
3 MR. HECHT: Oh, so that's in Chapter 7 or 4 is that elsewhere? You said the FSAR.
5 MR. BARTELME: The description of the 6 programmable logic life cycle in subsection 745 of the 7 FSAR, yes.
8 MR. HECHT: That's the description, but I 9 was asking more about the development plans and 10 standards.
11 MR. BARTELME: The documentation that has 12 been provided to support the upcoming audit is not 13 part of the licensing basis and we haven't made it a 14 part of the licensing basis nor docketed that.
15 MR. HECHT: Okay. So it sounds like it's 16 not clear as to whether the programmable logic 17 development plan and the associated standards have 18 been submitted or not.
19 MR. BARTELME: Yes. The programmable 20 logic development plan was part of that set of 21 planning phase documents that have been made available 22 to the NRC Staff.
23 MR. HECHT: Okay. But not part of the 24 FSAR, because I thought I read it and I didn't see it.
25 So that's fine. Do you know if there is anybody on NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
93 1 the NRC Staff who is capable of understanding whatever 2 hardware development by in which you are using?
3 MR. BALAZIK: This is Mike Balazik, NRC 4 Staff, the Project Manager for SHINE. Yes, at this 5 point we haven't completed our life cycle review of, 6 you know, this is in a future ACRS meeting where we 7 plan to discuss this.
8 So, you know, I guess I'd prefer not to 9 get too deep in the life cycle here. Like I said we 10 can address this at a later subcommittee meeting.
11 MR. HECHT: Okay. Thank you.
12 MEMBER BROWN: Are you finished Myron?
13 MR. HECHT: Well it was just pointing out 14 what, following up on what Dennis said. I would agree 15 with him that this is something that at the 16 appropriate time the DINC, the Subcommittee should be 17 looking into.
18 MEMBER BROWN: Okay. Yes, I think you got 19 that. I think Mike said we would be addressing this 20 later. I just wanted to know if you had anything 21 else. I had a question I wanted to ask also. You 22 done?
23 MR. HECHT: No, I'm done. I'm done.
24 MEMBER BROWN: Okay. Yes, this is Charlie 25 Brown again. I noticed when you all did NuScale you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
94 1 had two volatile FPGA, a volatile FPGA and a non-2 volatile FPGA in the process, you know, two in each, 3 one in each I guess, two in two channels, two in the 4 other channels.
5 In this case because you didn't meet the 6 standards that you needed to meet you now have gone to 7 three separate ones, which is fine, is there a reason 8 you picked two flash type as opposed to, which were 9 non-volatile, and only one of them volatile, is it 10 just easier to deal with or was there any thought at 11 all given to that or just picked one?
12 I personally don't like volatile 13 information being reprogrammed, but I like the choice.
14 I just wondered if you had a thought on it.
15 MR. POTTORF: Yes, Gregg, if you are on 16 you can probably address this better than I can.
17 MR. CLARKSON: Yes, certainly. Yes, this 18 is Gregg Clarkson with Rock Creek Innovations. Yes, 19 that's a good question.
20 On that third, that Division C, that Intel 21 flash type FPGA, we definitely chose that because we 22 like the behavior of the non-volatile FPGA.
23 Now I will note though that that Intel 24 flash type is really sort of a hybrid. It's got non-25 volatile attributes with flash memory aspects, but it NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
95 1 also has some of the volatile behaviors.
2 So it's really at the root of hybrid 3 architecture between the two, and that was another 4 reason we chose it, because that way, you know, it 5 really represents more of a third type, if you will, 6 than an all-volatile or an all-non-volatile for the 7 third type. Did that answer your question, Charlie?
8 MR. POTTORF: Did we lose him?
9 MR. CLARKSON: Yes, did I lose -- Okay, 10 you can hear me, Jason, okay.
11 MEMBER BROWN: No, I'm sorry, I turned my 12 mic off while you were talking.
13 MR. CLARKSON: Oh, okay.
14 MEMBER BROWN: I apologize for that. I 15 still haven't learned how to do this very well. I am 16 not computer literate according to some people, so --
17 Don't take that the wrong way.
18 Let me rephrase my question relative -- In 19 the NuScale as well as what you've got here you've got 20 volatile memory such that when you lose power you 21 obviously lose the programming of the FPGA and you 22 have to redo it when the power comes back. It's got 23 to reload.
24 I am only asking this question, I really 25 like the diversity of the non-volatile ones that you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
96 1 are using here as opposed to the volatile. I didn't 2 even think about it at the time and that what is the 3 probability that, you know, you lose power you have to 4 program, you lose power it re-programs.
5 You've got to have some confidence that 6 you are going to get re-programmed correctly every 7 time, you know, there is no glitches.
8 MR. CLARKSON: Right.
9 MEMBER BROWN: Did you all give that any 10 thought at the time or --
11 MR. CLARKSON: Yes.
12 MEMBER BROWN: -- is there any hint that 13 that is a long term, longer term problem or am I just 14 blowing smoke?
15 MR. CLARKSON: No, I think that's a great 16 point to make and certainly we looked at that. So 17 let's just talk that through with the Division Alpha, 18 the Microsemi Flash, are non-volatile.
19 So the way that works, you lose power, the 20 power comes back up, there is no re-programming. So 21 the configuration of the FPGA is retained, you know, 22 exactly with the gates interconnected in absence of 23 power because of the flash so they are maintaining 24 that inter-connectivity.
25 With the Division Bravo, the Xilinx, which NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
97 1 is the volatile type, what happens there is if you 2 lose power that FPGA completely loses its 3 configuration and upon power up it's going to get that 4 configuration from an adjacent integrated circuit, an 5 adjacent IC, that's a non-volatile memory that 6 provides, it sends the configuration over to the FPGA 7 and the FPGA, you know, the FPGA then powers up into 8 that configuration.
9 Now this third one, this Division Charlie, 10 this Intel, as I mentioned more of the hybrid, so what 11 it does is it has configured, it has the non-volatile 12 memory cells on the FPGA.
13 So it does not depend on an external IC 14 like the pure, you know, the pure volatile style. But 15 it also has some circuits that when you power up it 16 needs to configure itself, if you well, but it does it 17 on the same IC.
18 So, you know, what I did was I really 19 studied that and, you know, wanted to basically 20 account for -- You wouldn't have the same failure 21 mechanism I guess is what I am trying to say.
22 The three are different in how they work, 23 fundamentally work on the power up, so you wouldn't 24 have a common failure mechanism across the three. So 25 if your SRAM, for example, like you said, did not get NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
98 1 the configuration information correctly, okay, it's 2 not going to operate properly but the other two would 3 not have failed in the same way so they are going to 4 recognize that.
5 Your other two divisions are going to 6 recognize you got Division Bravo not agreeing. You 7 know, so that's why we, that's why that Intel hybrid 8 flash based won out in our book, you know, to be that 9 third type.
10 MEMBER BROWN: Okay, interesting. On the 11 NuScale approach with the four channels, recognizing 12 the same question, I walked away from that with the 13 thought well, gee, I've got two that are non-volatile, 14 therefore, if I come back and I lose something, but 15 that's kind of a single failure approach.
16 If something happened while we were 17 powering back up and we needed a response I had two 18 channels that were working and would provide the two 19 out of four that you need.
20 MR. CLARKSON: Right.
21 MEMBER BROWN: So, you know, I walked away 22 from what we did on NuScale with that thought process, 23 but it's just been nagging behind me. I like your 24 explanation and I appreciate the insight you just gave 25 me.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
99 1 I am not a designer, so that's why I 2 wanted to ask the question.
3 MR. CLARKSON: No, that's a great 4 question, and like I said it was very -- You know, so 5 it's really important when you are designed these, 6 what we call the power-on reset circuit --
7 MEMBER BROWN: Yes.
8 MR. CLARKSON: -- is really critical here 9 because as voltage is coming up, you know, it comes up 10 over a period of time, it's a short period of time, 11 but what you do not want to do is you do not want that 12 FPGA to be released to reset prior to the voltage 13 being stable.
14 So you want to give everything the proper 15 voltage, all of circuitry the proper voltage, and 16 then, you know, you want to make sure that in the SRAM 17 case that it's had a chance to get its configuration 18 over and everything is proper and then, you know, then 19 you are allowed to release reset and let the circuit 20 do what it's doing.
21 So a lot of care is taken on that, and 22 I'll just say in simple terms how each of these three 23 handle power on reset they are different from one 24 another in that very minute detail of design.
25 MEMBER BROWN: Okay. All right. I have NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
100 1 seen circumstances in a couple applications I dealt 2 with in my old, old where we had a rapid cycling of 3 power, you know, power was restored and all of a 4 sudden something else tripped off and it was then 5 seconds it came back so that, so it cycled a couple of 6 times.
7 So you are telling me that you don't like 8 that to happen with the non-volatile types 9 particularly?
10 MR. CLARKSON: Correct.
11 MEMBER BROWN: Okay.
12 MR. CLARKSON: Yes, you don't want to be 13 caught in that indeterminate state.
14 MEMBER BROWN: Yes.
15 MR. CLARKSON: And that power on reset 16 circuit is really there to make sure you don't -- You 17 know, no matter what, even like you said in like a 18 power glitch scenario, multiple glitches together --
19 MEMBER BROWN: Yes.
20 MR. CLARKSON: -- you don't want to ever 21 be at an indeterminate state. And so, yes, you want 22 to be very careful with that power on reset circuit 23 design.
24 MEMBER BROWN: Well we are more stable in 25 this because we do have battery backups that are NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
101 1 sitting there, so you shouldn't run into that 2 particular scenario.
3 All right. Well, thank you. I appreciate 4 the -- Thank you for the discussion on that and I 5 appreciate it.
6 MR. CLARKSON: Yes. Yes, you're welcome.
7 MEMBER BROWN: You can proceed whoever was 8 on Slide 4.
9 MR. POTTORF: Okay, yes. Sorry, I was on 10 mute as well there. Yes, if there is no more 11 questions on this, that was the major change to the 12 slides, so if we want to kind of walk through the rest 13 of them.
14 There were no changes here on the 15 architecture. If you keep going forward, I know the 16 other topic, Charlie, that you had was with respect to 17 a cybersecurity one-way flow of data from the system.
18 I would just point out that we have no 19 data connections for inputs of any kind into the 20 system from PICS. Everything interfaces with PICS 21 from this system are discreet inputs or outputs.
22 MEMBER BROWN: While you are mentioning 23 that, you don't happen to have a picture of 7.1-1, do 24 you, in your slide pac?
25 MR. POTTORF: No, I do not have it in this NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
102 1 slide pac.
2 MEMBER BROWN: Oh, okay. Okay, that's too 3 bad. I understand and I got that out of reading the 4 chapter. You've got more words -- You've probably 5 mentioned the words "one-way," "not unit directional,"
6 et cetera, at least 22 times throughout the -- I'm 7 pulling your -- That's a little bit of an 8 exaggeration, but you are very emphatic on that.
9 The reason I ask the question about the 10 7.1-1 is that that's the complete picture of how both 11 the ESFAS and the TRPS connect in and it's not clear 12 from looking at the picture that that's what you've 13 got relative to it.
14 But there is six red lines that go up out 15 of the system out of the MICM from I guess both the 16 two divisions of the TRPS and the two divisions of 17 ESFAS plus another spare one coming up from something 18 else.
19 So there are six inputs into the process 20 configuration and it would just be nice if those were 21 annotated as to being unit directional type 22 connections.
23 That makes it clear and you don't have to 24 search, word search the text, if you had a note with 25 that. You did that on the NuScale drawing, by the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
103 1 way, which was useful.
2 That's just a suggestion for clarity.
3 That's all. You are not required to do anything with 4 that unless you feel that it would be a good idea to 5 appease me, okay.
6 MR. POTTORF: Yes.
7 MEMBER BROWN: That was my only question 8 there, just the clarity on that. So I understand that 9 point. I do have a question later but I'll wait till 10 the end of all this so you get through everything.
11 It's semi-related, but it's not exactly 12 the same.
13 MR. POTTORF: Okay.
14 MEMBER BROWN: But you can proceed.
15 MR. POTTORF: All right, sounds good.
16 Next slide, please, Jeff. Okay, so there is where we 17 get into looking at specific changes to the HIPS 18 platform.
19 Next slide. This is kind of the outline 20 of those differences for the HIPS platform. No change 21 to this slide from before. Next slide. Again, no 22 changes here for this slide.
23 Also no changes here. This is where kind 24 of touching on, Charlie, what you were just talking 25 about there. That figure in the FSAR doesn't show the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
104 1 full details of the design implementation but we do 2 have that one-way flow of data that starts from each 3 of the MICMs in each division of the TRPS and the 4 ESFAS and we're actually aggregating all of those one-5 way outputs from the system into a set of redundant 6 chassis where we aggregate that information up and 7 then provide it over to the PICS system.
8 MEMBER BROWN: Can I ask, let me ask one 9 question relative to the one-way stuff. You use 10 almost four terms within the document, the FSAR. You 11 used the term "one-way," you use another term "one-way 12 data diode," another term "unit directional alone,"
13 and another term "one-way isolated." Are those all 14 the same?
15 MR. POTTORF: Yes.
16 MEMBER BROWN: Can you --
17 MR. POTTORF: Yes, all of those things are 18 implemented at the MICM when we provide that data out, 19 one-way via hardware data diode and it is isolated.
20 MEMBER BROWN: Okay. It just was the four 21 different terminologies, I wanted to make sure there 22 wasn't a nuance that I was missing somewhere.
23 MR. POTTORF: No. Yes, they are all 24 referring to the same equipment there.
25 MEMBER BROWN: Okay. Thank you. I'll ask NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
105 1 a question about gateway stuff later if that's okay.
2 MR. POTTORF: Okay.
3 MEMBER BROWN: So we can get through the 4 slides.
5 MR. POTTORF: Yes, go ahead, next slide.
6 Yes, I don't believe there are any changes to the 7 remainder of the slides here, so I think we can click 8 through them and stop if you have any specific 9 questions related to this.
10 This is covering the SBVM, which is a 11 combination of the SBM and the SVM that were described 12 in the HIPS platform topical that essentially all of 13 the logic functions are the same as they were as 14 described in the topical report.
15 Next slide. Just a figure to kind of show 16 how we have combined the two functions that were 17 described in the topical report into a single module 18 of the SBVM.
19 MEMBER BROWN: Is that now a single module 20 or I mean is it a re-designed single module concept as 21 opposed to now two separate modules?
22 MR. POTTORF: That's correct.
23 MEMBER BROWN: Okay.
24 MR. POTTORF: Instead of, yes, a separate 25 module in your signal conditioning and trip NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
106 1 determination chassis and in a separate module of the 2 SBM in the boating and actuation chassis.
3 Everything for signal conditioning and 4 trip determination may be, for sure in TRPS it's all 5 in one chassis whereas in ESFAS there are multiple 6 chassis for ESFAS, but those functions are all really 7 on the same module here.
8 I should point out that the logic that is 9 implemented for say the SBM is independent on the FPGA 10 from that logic that is used to implement the SVM.
11 Even though they are on the same FPGA they function 12 exactly as described in the topical report, which 13 would have been on two separate modules.
14 We're just doing everything on the same 15 module here.
16 MEMBER BROWN: Okay.
17 MR. POTTORF: Next slide. This is on the 18 remote input submodule. This is just a new module 19 that is essentially a mini safety function module that 20 we're putting out in the field that is associated with 21 a specific SFM in each division.
22 MEMBER BROWN: That's internal to the --
23 Yes, that's new.
24 MR. POTTORF: Yes, it --
25 MEMBER BROWN: I don't remember --
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
107 1 MR. POTTORF: But the way it functions is 2 no different as that described for an input submodule.
3 It's just simply we've pushed some of the 4 communication logic out into the field on a small 5 module.
6 I guess you could look at it as we have 7 taken an SFM and kind of split off a chunk of it and 8 put it out in the field.
9 MEMBER BROWN: What do you mean by "out in 10 the field?"
11 MR. POTTORF: So this is specific to 12 neutron instrumentation.
13 MEMBER BROWN: Oh.
14 MR. POTTORF: So rather than bringing 15 those signals with the very small voltages on them all 16 the way back to the control room we're digitizing that 17 out next to the IU cells right next to the amplifier 18 circuits and providing that via RS-485 connection back 19 to its respective safety function module that's in the 20 control room.
21 MEMBER BROWN: So that's the neutron flux 22 detection system you're talking about then is where 23 you are using them?
24 MR. POTTORF: Yes. We have a small module 25 that is out in the plant right next to the neutron NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
108 1 instrumentation equipment.
2 MEMBER BROWN: There is no -- That's 3 strictly an analog function until you get to the 4 transmitting, the RS-485?
5 MR. POTTORF: That's right.
6 MEMBER BROWN: Okay. And the RS-485 can 7 be bidirectional, but it's a hardware configured 8 communication device, isn't it? I have forgotten some 9 of that.
10 MR. POTTORF: It is one-directional, you 11 know, and that meets the way we have described the up 12 to four RS-485 channels that are available on each of 13 the HIPS modules. So we are using one of those 14 channels to provide that one-way flow of data to its 15 respective safety function module in the control room.
16 There is a second RS-485 connection that 17 would be used for configuring the configurable 18 parameters that are out on that module.
19 MEMBER BROWN: Are you -- In one of your 20 -- Back in the, what is it, the TECRPT, section on 21 gateway communications one of the ports in there was 22 bidirectional intentionally.
23 But the way that gateway is utilized it's 24 isolated so it didn't make it, but you're telling me 25 that -- Where is the bidirectional use and why is safe NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
109 1 again? You had a reason for why that was okay.
2 MR. POTTORF: So, yes, the gateway 3 functionality is not related to this remote input 4 submodule. I'll just point that out.
5 MEMBER BROWN: Okay, all right. Okay, all 6 right.
7 MR. POTTORF: But as far was that 8 gateway, we typically have for each MICM in each 9 division that's where we are providing that one-way 10 flow of data out from the TRPS and ESFAS.
11 That transmission of data goes to a set of 12 redundant gateway chassis where we have multiple 13 communications modules that are essentially collecting 14 all of the data from both the TRPS and the ESFAS, all 15 divisions, and then there is a set of communications 16 modules in those two chassis, redundant modules that 17 will then use MODBUS communications to PICS.
18 So that last chain in getting data out to 19 the PICS is your typically MODBUS bidirectional 20 communication. But all of the data that gets provided 21 to those modules originates from those one-way 22 connections from the MICMS to those gateway modules.
23 MEMBER BROWN: Yes, I saw that array, the 24 picture, it looks like about 20 or 30 of these 25 different little sub-ports if you want to call them NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
110 1 that.
2 MR. POTTORF: Mm-hmm.
3 MEMBER BROWN: But the gateways are up in 4 the, are they located up in the PICS? I don't want to 5 get into the PICS. Is that where they are physically 6 located?
7 MR. POTTORF: We put those two chassis in 8 the Division C, ESFAS Division C cabinet, because 9 there was room there.
10 MEMBER BROWN: Just a physical location, 11 not a architectural location though, operational wise?
12 MR. POTTORF: That's right, yes. So we 13 consider the modules in those two chassis that 14 communicate with the TRPS, those are a part of the 15 TRPS system scope.
16 The modules that receive the data from 17 each of the three ESFAS divisions are part of the 18 ESFAS scope and then we have the remainder of the 19 communications modules that actually communicate 20 bidirectionally all of that data.
21 So on the back plane of those chassis 22 those final modules are gathering up everything from 23 each of those TRPS and ESFAS gateway modules and 24 providing that over to PICS.
25 All non-safety functions going on in those NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
111 1 redundant chassis, but, yes, they are located in the 2 Division C ESFAS cabinet.
3 MEMBER BROWN: If the indication and 4 monitoring data from the TRPS it goes up to these 5 gateways you said that's all sent up into the PICS and 6 the same way with the ESFAS, do you maintain 7 separation of that data?
8 It's not mixed in the same gateways? I 9 mean in other words there is gateways dedicated to the 10 TRPS and to gateways dedicated to the ESFAS?
11 MR. POTTORF: Yes. They are maintained 12 separate into their respective modules in those two 13 gateway chassis and then once they get brought into 14 those modules in those two chassis they are provided 15 over to separate modules on the back plane in those 16 chassis so that they can be provided over to PICS via 17 a separate set of modules.
18 MEMBER BROWN: Okay. But the circuits are 19 separate, you're not mixing data?
20 MR. POTTORF: That's correct.
21 MEMBER BROWN: That answers that. That's 22 all. That's what I was looking for.
23 MR. POTTORF: The very last module that 24 provides the data to PICS we do provide everything, 25 but everything is maintained independent and separate NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
112 1 over into separate modules in those chassis as well.
2 MEMBER BROWN: When you get that last 3 module do you lose all indication and monitoring off 4 into PICS?
5 MR. POTTORF: We have redundancy so there 6 are the two chassis, so they essentially have an 7 identical set of modules in each of the chassis there 8 so that if we were to lose one of those final modules 9 we would still have that redundant module in the other 10 chassis providing all data over to PICS.
11 MEMBER BROWN: How does PICS determine 12 which module to take data from then when you are in 13 operation if it's the same data?
14 MR. POTTORF: I would not be the best one 15 to answer that question.
16 MEMBER BROWN: Okay. Well we'll save that 17 for the PICS discussion. Just put that as a note for 18 something for SHINE to tell us about -- I don't know 19 whether that's your responsibility or not, so that 20 would be a question that was -- There is very little 21 detail.
22 I've got a number of questions that I am 23 concerned about on the PICS because of the level of 24 detail, but we can save that for the PICS subcommittee 25 meeting.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
113 1 So whoever hears this in the transcript 2 can remember that I've got some other questions on 3 that later.
4 MR. POTTORF: Sure.
5 MR. BARTELME: Yes, we've got that here, 6 John.
7 MEMBER BROWN: Okay. Yes, who is that 8 just spoke?
9 MR. BARTELME: This is Jeff Bartelme from 10 SHINE.
11 MEMBER BROWN: Okay. Well Staff ought to 12 pay attention that also I hope. Okay, thank you.
13 MR. POTTORF: Yes. Okay, Jeff, if you 14 want to go to the next slide, please. Yes, this slide 15 is really what we were just talking about there with 16 the gateway communications modules.
17 Next slide. I think we should be close to 18 the end. No changes on this slide covering self-19 testing. Next slide. Yes, no changes here on the 20 LEDs on the front panels of the HIPS modules. Next 21 slide.
22 MEMBER BROWN: Don't backtrack the slides, 23 just does the use of gateways now complicate your 24 self-test in terms of verifying what's coming from 25 what place that goes to another and that the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
114 1 monitoring and indicating is going to be accurate?
2 That's a complicated setup with the 3 gateways. That's my only thought.
4 MR. POTTORF: Yes, I don't think there is 5 any impact as far as self-testing that is performed.
6 We are still doing the self-testing on each module as 7 described in the topical report.
8 MEMBER BROWN: Okay. Okay, so that shows 9 up on LED active lights or something like that on the 10 modules themselves?
11 MR. POTTORF: Yes, that's correct. You 12 know, and that would be specific to the self-testing 13 that is implemented on each individual module.
14 MEMBER BROWN: Okay. All right, okay.
15 Thank you.
16 MR. POTTORF: Yes.
17 MR. CLARKSON: Yes, this is Gregg 18 Clarkson. I will just add to that, Charlie, that your 19 question there with the addition of the gateways, 20 actually I would say that it helped our self-testing 21 because the gateway if you think about it is a place 22 that is aggregating that the monitoring and indication 23 data to ultimately send to PICS, but because you have 24 all of it there together you can do channel checks.
25 So it's a nice place to do, you know, an NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
115 1 Alpha, Bravo, Charlie division channel check, you 2 know. So I think it actually helped our testing and 3 gave us a little bit more visibility, you know, for 4 that automated channel check.
5 MEMBER BROWN: Well the word "aggregate" 6 just makes it sound like all the data is jumbled up 7 and then spit out somewhere, you know, based on field 8 data and what assigns what to what.
9 So that was one of my thoughts when I saw 10 the word "aggregate." So you're telling --
11 (Simultaneous speaking.)
12 MR. CLARKSON: Well like Jason said though 13 we were very careful to maintain that data stream is 14 independent, you know, from each division, TRPS and 15 ESFAS, and the independent modules to basically make 16 sure we weren't sacrificing the protection system.
17 And then once we get that data over 18 independently then, you know, on that final module is 19 where you put it together. And it's not aggregated, 20 it's very thoughtfully packaged up and then it's 21 provided to the PICS.
22 But it's at that point there we can do an 23 Alpha, Bravo, Charlie comparison, you know, and say, 24 okay, these two are really close to the same but this 25 third one is way out, something is going on there, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
116 1 let's throw an alarm for that.
2 MEMBER BROWN: Yes, that's what I was 3 looking for, the ability to compare the various 4 divisions to make sure you are okay, but if you 5 aggregate it -- Identifying data and making sure you 6 are consistent becomes a consistency issue but you are 7 saying you are separate from your ability to compare 8 the data coming in from each division?
9 MR. CLARKSON: Yes. And keep in mind that 10 gateway, you know it's also implemented on all FPGAs, 11 so all of that logic, you know, is finite-sate 12 machines, completely deterministic.
13 It has to function the same very time, so 14 there is really no jumbling, first come, you know, 15 first serve type of thing. It works the same always, 16 so the structure is very rigid.
17 You always know what data is what and 18 where it came from because it's the same every time as 19 far as the structure of how the data is packaged.
20 MEMBER BROWN: Okay. Thank you.
21 MR. CLARKSON: Mm-hmm.
22 MR. POTTORF: All right. Next slide.
23 MR. BARTELME: Jason, I believe that's the 24 last of the slides here.
25 MR. POTTORF: That should be it, yes.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
117 1 MEMBER BROWN: Okay. You're finished with 2 that package slides on the HIPS then?
3 MR. POTTORF: Yes.
4 MEMBER BROWN: Does anybody else have any 5 other questions? Dennis, do you have anything else?
6 DR. BLEY: No, Charlie, thanks.
7 MEMBER BROWN: Okay. Okay, I guess we're 8 ready to switch over to whatever is next on the 9 schedule. There is three different sets of slides if 10 I remember, is that correct?
11 MR. BARTELME: Yes. We'll move over to 12 TRPS/ESFAS slides now. I'll get those pulled up.
13 MEMBER BROWN: Okay. Is this the open 14 set?
15 MR. BARTELME: That's correct, yes.
16 MEMBER BROWN: Okay.
17 CHAIRMAN BALLINGER: Who's got the slides?
18 MR. BARTELME: Can you guys see it? Can 19 everyone see the slides now?
20 CHAIRMAN BALLINGER: I can. Thank you.
21 MR. BARTELME: Okay.
22 MS. RADEL: Okay. This is Tracy Radel.
23 I am going to cover the Target Solution Vessel 24 Reactivity Protection System, or TRPS, and the 25 Engineered Safety Features Actuation System, or ESFAS.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
118 1 Outline for the presentation, first we 2 will cover an overview of TRPS and then move into the 3 functions and monitored variables and then the mode 4 transitions permissives and bypasses.
5 For ESFAS we will provide an overview 6 along with the functions and monitored variables and 7 then we'll touch on the priority logic and then the 8 TRPS/ESFAS interfaces with the Process Integrated 9 Control system, or PICS.
10 The TRPS is designed using the HIPS 11 platform. It monitors variables important to safety 12 functions of the irradiation process and performs 13 safety functions required by the SHINE safety 14 analysis.
15 It consists of eight independent instances 16 of TRPS, each one dedicated to an individual 17 irradiation unit. There are three divisions of 18 monitoring equipment with two out of three coincident 19 logic votes and there are nine total cabinets for the 20 facility.
21 The first three cabinets cover IU cells 1 22 and 2 with Divisions A, B, and C, and then there are 23 three cabinets, Division, A, B, and C, to cover IU 24 cells 3 through 5, and then an additional three 25 cabinets for cells 6 through 8.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
119 1 You will notice that that division of 2 cabinets aligns with the phased approach that will 3 covered in a future ACRS meeting.
4 Moving into the TRPS functions, the safety 5 functions are listed here in the IU cell safety 6 actuation, IU cell nitrogen purge, IU cell tritium 7 purification system, or TPS actuation, driver dropout, 8 and then there is one non-safety function within the 9 TRPS, which is the fill/stop function.
10 The IU cell safety actuation is initiated 11 based on process variables that would indicate an 12 insertion of access reactivity, a loss of cooling 13 events, overcooling, loss of hydrogen re-combination 14 capability, or breach of the primary system boundary.
15 The IU cell safety actuation transitions 16 the unit to Mode 3 shutting down the irradiation 17 process by opening the TSV dump valves and opening the 18 breakers to the high voltage power supply for the 19 neutron drivers assembly system.
20 It also isolates the primary system 21 boundary as well as the primary confinement boundary.
22 The IU cell nitrogen purge is initiated based on 23 process variables indicating a loss of hydrogen re-24 combination capability and isolates the radioisotope 25 process facility cooling system, or RPCS, to limit NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
120 1 water intrusion.
2 This is for a very specific accident 3 scenario which is related to flooding of the primary 4 system boundary which would prevent offgas system 5 flow, and so in response to an event we do isolate 6 that source of water.
7 MEMBER BROWN: Can I interrupt you for 8 just a second?
9 MS. RADEL: Yes.
10 MEMBER BROWN: This is just a calibration 11 question. I just want to make sure that everybody 12 from the Committee that is participating that the 13 TRPS, the target solution vessel reactivity protection 14 system, there is one of those for each of the eight IU 15 cells.
16 The ESFAS is a facility protection system 17 and there is only one of those for the whole facility.
18 So I am just trying to make sure you understand what 19 the configuration is for how the systems are applied.
20 So sorry to interrupt you. Just a little 21 bit of a pictorial thought process, that's all. So 22 thanks for holding up for a minute.
23 MS. RADEL: Yes. Appreciate the 24 clarification. The IU cell nitrogen purge provides a 25 purge of the primary system boundary for the affected NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
121 1 irradiation unit with nitrogen.
2 So note that an individual unit could 3 undergo a nitrogen purge while other units continue to 4 operate. It does this by opening the nitrogen purge 5 and vent isolation valves.
6 It also, as you'll see as we get into 7 ESFAS, does send a signal to ESFAS to open the IU and 8 TPS header valves as well.
9 The IU cell TPS actuation is initiated 10 based on process variables indicating a breach of the 11 tritium boundary within the IU cell or supply return 12 lines or a breach of the tritium boundary in the TPS 13 glovebox.
14 It isolates the TPS lines into an out of 15 the IU cell and isolates the radiological ventilation 16 zone one exhaust, RVZ1 exhaust, out of the IU cell.
17 This signal comes from the ESFAS which also isolates 18 the glovebox confinement and tritium room dampers.
19 Driver dropout is initiated based on 20 process variables indicating a loss of neutron driver 21 output or loss of cooling. These are really two 22 separate functions of the driver dropout.
23 On the loss of driver output it opens the 24 NDAS high voltage power supply breakers to terminate 25 the irradiation process after a time delay. On NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
122 1 Function 2 where have lost cooling either through high 2 temperature or through cooling flow it opens the NDAS 3 high voltage power supply breakers without a delay.
4 It also initiates an IU cell safety actuation after 5 the 180-second delay.
6 Moving into the TRPS monitored variables 7 and response, this slide covers those related to 8 neutron flux. The high source range neutron flux 9 protects against an insertion of excess reactivity 10 during the filling process.
11 It initiates an IU cell safety actuation 12 when two out of three or more signals are active. The 13 low power range neutron flux protects against loss of 14 the neutron beam followed by a restart of the neutron 15 beam outside of analyzed conditions.
16 The driver dropout is initiated when two 17 out of three or more signals are active for a 18 predetermined amount of time.
19 High time average neutron flux protects 20 against exceeding analyzed TSV power levels during 21 Mode 1 and 2 and it initiates an IU cell safety 22 actuation when two out of three or more signals are 23 active.
24 The high/wide range neutron flux protects 25 against exceeding target solution, power density, and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
123 1 temperature limits during Mode 1 and 2 and it 2 initiates an IU cell safety actuation when two out of 3 three or more signals are active.
4 Moving into the cooling systems, we have 5 a high primary closed loop cooling system, or PCLS, 6 temperature, which protects against a loss of cooling 7 that could cause target solution heat up.
8 It initiates an IU cell safety actuation 9 when two out of three or more signals are active for 10 three minutes or 180 seconds.
11 Low PCLS temperature protects against an 12 overcooling of the target solution that could cause an 13 excess reactivity insertion. It initiates an IU cell 14 safety actuation when two out of three or more signals 15 are active.
16 Low PCLS flow protects against a loss of 17 cooling that could cause target solution bulk boiling 18 and initiates an IU cell safety actuation when two out 19 of three signals are active for three minutes or 180 20 seconds.
21 In the TSV dump tank we have two level 22 instruments. We have the low-high and the high-high.
23 So the low-high protects about in-leakage into the 24 primary system boundaries during Mode 1 and 2 that 25 could result in loss of the TSV offgas system, or NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
124 1 TOGS, flow to the TSV dump tank headspace.
2 It initiates an IU cell safety actuation 3 and an IU cell nitrogen purge when two out of three or 4 more signals are active.
5 The high-high TSV dump tank level is 6 protecting against a similar in-leakage event. During 7 Mode 3 primarily is when this is relied on, when the 8 low-high is bypassed because we have the target 9 solution or TSV dump tank.
10 The high-high protects us on the water 11 ingress event. It initiates an IU cell safety 12 actuation and IU cell nitrogen purge when two out of 13 three signals are active.
14 In the offgas system these are focused on 15 detecting the loss of hydrogen recombination 16 capability. We have the low TOGS oxygen 17 concentration.
18 So this protects against deflagration in 19 the primary system boundary caused by the inability to 20 recombine hydrogen with oxygen. Really in operation 21 we do expect oxygen to come out of the solution at a 22 slower rate than the hydrogen.
23 So oxygen is injected into the system and 24 we also monitor for oxygen concentration and initiate 25 an IU cell safety actuation and an IU cell nitrogen NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
125 1 purge if two out of three or more signals are active.
2 For flow we monitor the TOGS mainstream 3 flow which protects against deflagration caused by an 4 inability to sweep accumulated hydrogen through the 5 TOGS hydrogen recombiners.
6 On low flow an IU cell safety actuation 7 and an IU cell nitrogen purge would be initiated when 8 two out of three or more signals are active.
9 We also monitor flow, directly monitor 10 flow, to the dump tank. This protects against 11 deflagration in the TSV dump tank caused by an 12 inability to remove the accumulated hydrogen and also 13 initiates an IU cell safety actuation and IU cell 14 nitrogen purge.
15 High TOGS condenser to mister outlet 16 temperature, this protects against failure of the 17 condenser to mister which could cause adverse effects 18 on hydrogen recombination, TOGS instrumentation, or 19 the TOGS zeolite bed.
20 An IU cell safety actuation and IU cell 21 nitrogen purge would be initiated when two out of 22 three or more signals are active.
23 Additional monitor and variables within 24 TRPS are the ESFAS loss of external power. This is a 25 signal coming from the ESFAS indicating that power has NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
126 1 been lost for (audio interference) three minutes or 2 180 seconds.
3 This will open the TSV dump valves and 4 initiate the IU cell nitrogen purge of the system.
5 Note that the TOGS blowers continue to operate for 6 five minutes, so we start the nitrogen purge prior to 7 losing the TOGS blowers.
8 The high RVZ1, the IU cell exhaust 9 radiation, protects against a breach in the primary 10 system boundary limiting the radiological release. So 11 upon detection of radiation in the exhaust pathway it 12 would initiate an IU cell safety actuation when two 13 out of three or more signals are active.
14 TSV fill isolation valve position 15 indication not closed protects against inadvertent 16 addition of target solution to the TSV and initiates 17 an IU cell safety actuation when one out of two or 18 more signal is active.
19 ESFAS IU cell TPS actuation protects 20 against tritium release events in the TPS and 21 initiates an IU cell TPS actuation upon receipt of a 22 discreet signal from ESFAS.
23 MEMBER BROWN: Just a momentary -- Your 24 slides by the way are the cutting off the last line or 25 two sometimes the way they are positioned, just NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
127 1 letting you know that.
2 The IU cell line, bullet, is not there, at 3 least it's not on my computer, I'll put it that way.
4 MEMBER HALNON: Charlie, I'm good. Check 5 your screen. Maybe you need to maximize it or 6 something.
7 MEMBER BROWN: I just clicked it. I just 8 went off to something else and started clicking things 9 and now it popped up, so thank you. I'm glad I said 10 something.
11 MEMBER DIMITRIJEVIC: Charlie, this is 12 Vesna. Can I take a little diversion in connection 13 with my previous question in fire protection?
14 MEMBER BROWN: Yes, go ahead.
15 MEMBER DIMITRIJEVIC: So when we discussed 16 fire protection you said that safe shutdown analysis 17 that human actions were not credited and it was 18 assumed the fire in the analyzed area will generate 19 signal.
20 So did you trace what type of signal was 21 analyzed for the, was generated in different fire 22 areas, the one which will cause the trip?
23 MS. RADEL: To clarify, it's not assumed 24 that the fire will cause a signal and a trip. It is 25 that we continue to monitor all of these variables and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
128 1 if there is an upset condition if we do lose flow, we 2 do have high or low temperature, we have high neutron 3 flux, or we lose, you know, the neutron driver, the 4 safety system will take the proper action to perform 5 its safety function.
6 It's due to that redundancy and routing 7 through separate fire areas and make sure the 8 separation that is what is credited there for --
9 Essentially the system continues to monitor and 10 actuate as needed.
11 MEMBER DIMITRIJEVIC: I think this is, I 12 feel actually, really, to understand that when we are 13 discussing but now when I am looking through your 14 signals and trying -- So let's say that you are having 15 some, you know, the MCC room fire, what would -- Okay, 16 first, your definition of safe shutdown is the plant 17 is tripped and the solution is done, right, that's a 18 general definition of safe shutdown.
19 So let's say that you have a fire in, that 20 you lose the hydrogen, you know, the combustible which 21 is one of your signals, or whatever, how do you assume 22 you are achieving safe shutdown given, for example, 23 fire in that SOC (phonetic) MCC room?
24 MS. RADEL: The MCC fire is specifically 25 analyzed to ensure that we would not lose both the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
129 1 Division A and the Division B MCCs because those are 2 for the TOGS blowers and heaters because those are 3 relied on for five minutes following shutdown.
4 And so that is specifically analyzed in 5 the fire modeling to ensure that we would maintain at 6 least one division of that equipment, you know.
7 Within the emergency procedures there will be, there 8 is a definition of when the operators will shut down 9 the facility based on the size of the fire, and 10 Catherine can speak to that.
11 I was speaking to the kind of safety 12 aspect of it that the systems are independent enough 13 to take their own action and still maintain their 14 safety functions during a fire event --
15 (Simultaneous speaking.)
16 MEMBER DIMITRIJEVIC: Okay, so now I sort 17 of understand that, because as I understood you this 18 morning that you said you cannot safe shutdown without 19 tripping and damping the vessel, right, that's your 20 definition of safe shutdown, right.
21 So, okay, I said the something, you said 22 that it's not, but it's actual, in general you do 23 credit these operator actions for those fires in these 24 areas, right?
25 MS. RADEL: We don't credit operator NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
130 1 action for safety, but to reach our safe shutdown 2 definition there would be an operator action taken.
3 MEMBER DIMITRIJEVIC: All right. So 4 that's where we had the misunderstanding, all right.
5 Now I understand, thanks.
6 MS. RADEL: Yes. Moving into the mode 7 transitions and permissives. So the mode transitions 8 and permissives are really to prevent the unit from 9 tripping immediately after a mode transition, you 10 know, when things are inactive in one mode and then 11 active in the next.
12 So it's looking to make sure that, you 13 know, the system is set up for operation in the next 14 mode, so, you know, Mode 0 to Mode 1, ensuring that 15 all TSV dump valve position indication (audio 16 interference) isolation valve position indications 17 indicate fully closed.
18 TOGS mainstream flow is above the minimum 19 flow rate. Mode 1 to Mode 2, that the TSV fill 20 isolation valve position indications indicate both 21 valves fully closed.
22 Mode 2 to 3, all high voltage power supply 23 breaker position indications indicate the breakers are 24 open. Mode 3 to 4, IU cell safety actuation is not 25 present, and then Mode 4 to Mode 0, that the TSV dump NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
131 1 tank level is below the low-high TSV dump tank level.
2 Moving into bypasses, for Mode 0 the list 3 of signals listed there are bypassed. Mode 0 again is 4 when there is no target solution in the primary system 5 boundary sources when the unit does not contain target 6 solution.
7 In Mode 1, this is the filling mode, we 8 have bypasses on the lower power range neutron flux, 9 such as which is for driver dropout. It's not 10 necessary in Mode 1.
11 TSV fill isolation valve position 12 indication not closed. We do expect to open the fill 13 valves during the filling mode and then low PCLS flow 14 and high PCLS temperature.
15 I do want to note that these signals are 16 not bypassed for the IU cell safety actuation 17 function, but they are bypassed for driver dropout.
18 So these signals feed into two separate actuations and 19 it is only the driver dropout portion that is bypassed 20 in Mode 1.
21 Mode 2, high source range neutron flux.
22 Mode 3 and 4 have the same list of items here, and 23 this is when the target solution has been dumped to 24 the TSV dump dank.
25 We have our neutron flux input and then NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
132 1 PCLS because PCLS is not needed at that point when the 2 light water pool is providing cooling and then low-3 high TSV dump tank level and TSV fill isolation valve 4 position indication not closed.
5 The reason that that is bypassed in Mode 6 3 is that there is solution within the TSV hold tank 7 that we may want to add to the dump tank prior to 8 transfer through the hot cell, so that gives us the 9 ability to do that.
10 MEMBER BROWN: Can I ask a question 11 relative to Mode 3? This is Charlie.
12 MS. RADEL: Yes.
13 MEMBER BROWN: Mode 3 is post-irradiation 14 and then you move it off to the production facility.
15 Is there a resting period or some period that you have 16 to hold it in Mode 3 for a while before you do 17 anything after the irradiation?
18 MS. RADEL: Yes, there is, but it's a 19 proprietary number and I'd be happy to cover that in 20 the closed session.
21 MEMBER BROWN: Okay. I just wanted to 22 know if there was a resting period, that's all.
23 MS. RADEL: Yes.
24 MEMBER BROWN: I don't need to know the 25 number, okay. I was just trying to understand the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
133 1 wiring diagram you had in one of your figures plus the 2 discussions and I was curious as to whether that was 3 necessary. So that's good enough for me. Thank you.
4 MS. RADEL: Yes. Okay, any questions on 5 TRPS before we move into ESFAS?
6 (No audible response.)
7 MS. RADEL: Okay. So the ESFAS is also 8 designed using the HIPS platform. As indicated 9 earlier there is one ESFAS system for the facility.
10 It monitors the variables that are important to safety 11 functions in the radioisotope production facility, or 12 RPF, as well as the tritium systems.
13 It performs safety functions required by 14 the SHINE safety analyses and there are three 15 divisions of monitoring equipment with one out of two 16 or two out of three coincident logic vote, depending 17 on the operability considerations.
18 MEMBER BROWN: That's -- I had a question 19 here. Excuse me. When you talk about two out of 20 three or one out of two, that's definitely a change 21 from the TRPS approach.
22 There you are two out of three and always 23 two out of three and why the differentiation for it's 24 okay to be one out of two, you're allowing as 25 operation with one of the channels out of service NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
134 1 (audio interference).
2 MS. RADEL: So it's completely and 3 operability consideration on the need for reliability 4 of different systems and different functions and the 5 ability to, you know, adjust the production with the 6 different functions so we can discuss based on the 7 different functions why we chose the way we did.
8 MS. KOLB: And this is Catherine Kolb.
9 Just to be clear, some of the SS channels only have, 10 or some of the SS variables only have two channels.
11 So, it's not that we're designing 12 differently, and neglecting one of the three channels.
13 Some of the variables only have two channels.
14 MEMBER BROWN: That wasn't obvious from 15 looking at the pictures, and the words I read. The 16 first time I came across this was when I read 17 Section 7.5.1, paragraph six. Okay?
18 So, it certainly wasn't obvious that there 19 was only channels of ESFAS at any time. I thought it 20 was a total three-channel operating system, and that 21 the only reason for going to the one-out-of-two was 22 because you're not in a fission-type reactor 23 operation-type setup that, for reliability on the 24 production front, if you lost a channel, you wanted to 25 be able to continue with the production aspects.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
135 1 So, I guess, my thought process was not 2 correct. It certainly wasn't obvious where there were 3 only two channels required for any particular -- the 4 29 safety functions that are performed in the ESFAS.
5 MS. KOLB: This is Catherine again. If 6 you look at the logic diagrams, that's more clear on 7 which variables have two channels versus three, 8 because two inputs are shown into the logics versus 9 three.
10 MEMBER BROWN: Okay. Well, talking about 11 that fourteen or fifteen pages of fine print that you 12 need a magnifying glass to read. Correct?
13 MS. KOLB: It's also identified in the 14 technical specifications, where it says, required 15 channels, in the various --
16 MEMBER BROWN: Which is not part of this 17 discussion.
18 MS. KOLB: Understand. Understand.
19 MEMBER BROWN: I made the comment earlier, 20 that the tech specs is at not a very good place for 21 identifying these particular variations of operability 22 conditions. It really ought to be in the check.
23 MS. KOLB: No, I apologize. It's also in 24 table 7.4.1. and 7.5.1. It distinguishes which 25 variables have two channels versus three.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
136 1 MS. RADEL: If I understand correctly, 2 some of the confusion is, whenever it is a one-out-of-3 two, if you have a Division A and a Division B in 4 there, there is no Division C of the instrumentation 5 there.
6 When it says two-out-of-three within those 7 tables, they are the A, B and C Divisions of input.
8 MEMBER BROWN: So, you've really got both 9 the protection divisions still available.
10 MS. RADEL: Correct. There is always a 11 Division A and a Division B.
12 MEMBER BROWN: Okay. So, all you're 13 missing is the third data channel, where you're 14 showing the actuations required.
15 MS. RADEL: Correct.
16 MEMBER BROWN: Okay, very difficult in the 17 limited amount of time we had to go through those 18 logic diagrams and the tables, and put all those 19 little things together. So, all right, that's good.
20 You explained it to me. I appreciate that.
21 MS. RADEL: We appreciate the question.
22 There are three cabinets for the ESFAS, the Division A 23 cabinet, Division B cabinet and the Division C 24 cabinet.
25 The safety functions within the ESFAS are NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
137 1 the RCA Isolation, Super Cell Isolation, Carbon Delay 2 Bed Isolation, Vacuum Transfer System, or VTS, Safety 3 Actuation, TPS Train Isolation, TPS Process Bent 4 Actuation, IU Cell Nitrogen Purge, RPF Nitrogen Purge, 5 Moly Extraction and Purification System, or MEPS, 6 Heating Loop Isolation, Extraction Column, and Iodine 7 and Xeonon Purification and Packaging, or IXP, 8 Alignment Isolation, and the Dissolution Tank 9 Isolation.
10 The RCA Isolation is initiated based on 11 process variables indicating efficient product release 12 into RVZ-1 or RVZ-2 areas of the facility, or a breach 13 to the tritium boundary within an IU cell, supply 14 return lines, or a TPS glove box.
15 The RCA isolation closes the RVZ dampers, 16 and turns off blowers for the RVZ-1 and RVZ-2, and 17 initiates a super cell area isolation, VTS safety 18 actuation, TPS train isolations, and TPS process vent 19 actuations.
20 Supercell isolation. Note that there are 21 isolations for each of the ten areas of the supercell.
22 And so, initiated based on process variables 23 indicating fission product released into a supercell 24 area of confinement.
25 It closes the inlet and outlet dampers for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
138 1 the supercell area that is affected. It initiates a 2 VTS safety actuation if the release occurs in the 3 process special vent system, PVVS, or extraction areas 4 of the hot cells. It initiates a MEPS Heating Loop 5 Isolation if the release occurs in an extraction area.
6 MEMBER BROWN: Can you back up to the 7 supercell again for me for a minute? This is an off-8 the-wall question.
9 The supercell is another -- I'm trying to 10 figure out the right word for it. We've got it 11 covered with ESFAS, but there's a lot of control 12 functions associated with supercell operation. At 13 least that's what I kind of gathered out of reading 14 the supercell stuff.
15 MS. RADEL: Yeah, so the supercell is a 16 bank of ten hot cells. It's where our processing 17 occurs where we extract and purify isotopes. There's 18 also the PVVS cell is where a lot of the equipment for 19 the vent system is located, such as we can do 20 maintenance and replacement of components.
21 So, those hot cells each have their own 22 confinement. So, there's ten individual confinements 23 with inlet and outlet dampers, and isolation valves 24 for process lines going into and out of the cells.
25 And we can isolate each area individually.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
139 1 MEMBER BROWN: The reason I ask the 2 question is that it's also covered, what I recall, 3 under the -- one of the boxes on the control system 4 for the supercell is covered under the PICS.
5 And the PICS has an ethernet external 6 connection, based on the 7.1-1, and it's also 7 mentioned in the text.
8 So, I guess whenever we get around to that 9 at some point, I'd like to hear how we maintain our 10 no-external-connections to the Internet for, 11 particularly, the supercell, but probably everything 12 else that's covered under the PICS area. That's later 13 for another discussion. That's just something to lay 14 on the table.
15 I'm obviously bothered by what they call 16 vendor-provided control systems, non-safety-related, 17 but the supercell has got to have control systems 18 somewhere. And if it's computer-based, then you want 19 to make sure it's not connected to anything. You 20 certainly can't put virus software into the supercell 21 control systems.
22 (Simultaneous speaking.)
23 MS. KOLB: Hopefully, I can address this 24 quickly. This is Catherine Kolb. The vendor-provided 25 control systems are physically in the facility.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
140 1 Maybe that was confusing there, but we're 2 not connecting to a cloud-based thing or at a vendor 3 facility. The vendor provided the control system, but 4 it's physically in our facility.
5 MEMBER BROWN: Well, it says this has an 6 ethernet connection in the text. That's why I ask the 7 question.
8 MR. WATTSON: Yeah, this is Bill Wattson.
9 I'm the INC manager. It is an ethernet connection, 10 but it's internal ethernet, and it's only connected 11 within the layer-four of our cybersecurity model --
12 (Simultaneous speaking.)
13 MEMBER BROWN: Oh, okay. All right, it's 14 not external-external then. It's internal-external.
15 Or external-internal. It's internal to the facility.
16 It's an ethernet around the facility.
17 MS. RADEL: Correct.
18 MEMBER BROWN: Okay, thank you. That's 19 good. Wasn't clear from the reading. That's all.
20 MS. RADEL: Good. The next function is 21 the carbon delay bed isolation. This is initiated 22 based on process variables indicating a fire in the 23 PVVS carbon delay bed-one, -two, or -three, and 24 isolates and bypasses the impacted beds, suppressing 25 for fire while maintaining flow through the other NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
141 1 seven beds.
2 I do want to note that this is different 3 from the off-star version that you likely saw, so we 4 are no longer isolating CO, carbon monoxide, for the 5 PVVS fire scenario. We are isolating based on 6 temperature.
7 And rather than a delay bed group 8 isolation, it is a isolation of the individual carbon 9 delay beds for beds one, two and three. And then, 10 there is no safety-related isolation provided for beds 11 four through eight.
12 This change was initiated based on the 13 analysis that showed that full release of maximum 14 inventory off of beds four through eight would not 15 exceed the SHINE safety criteria.
16 And so, we can cover more on that kind of 17 change and design at the next ACRS meeting.
18 MEMBER HALNON: Tracy, this is Greg. What 19 are the size of these carbon beds? Just 20 approximately.
21 MS. RADEL: They're very large. They just 22 appeared onsite last week. I don't know the exact 23 size, but we can get that for you though.
24 MEMBER HALNON: Okay. My thought was that 25 when a fire heats some combustion in a bed, it's very NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
142 1 localized. And I'm sure they're largely dependent on 2 whether the sensors are.
3 So, where are the sensors, relative to the 4 carbon? And how do you answer the question about a 5 gray, localized fire starting, or combustion?
6 MS. RADEL: The sensors are located on the 7 out-limit line at the exit of the carbon delay beds, 8 each carbon delay bed.
9 Our analysis for this event is assuming 10 that the entirety of the affected delay bed, all of 11 the radionuclides on that affected bed are released 12 prior to isolation. And the set point for the 13 temperature sensors is based on the requirement that 14 the next bed not start on fire due to the temperature 15 exiting the delay bed.
16 MEMBER HALNON: Okay, so just running it 17 through the isolation will cause the bed to suffocate 18 basically, and the next bed will not catch because of 19 the heat. Is that restating correctly?
20 MS. RADEL: Correct. The isolation will 21 isolate the bed that is affected by fire, suppressing 22 the fire. And then, bypass that bed such that flow 23 will still pass through the other seven carbon delay 24 beds.
25 MEMBER HALNON: Okay, is that through a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
143 1 failure of one of the dampers to isolate?
2 MS. RADEL: Yes. The valves -- yes. It 3 includes a single failure of valves. Yes.
4 MEMBER HALNON: Okay. All right, thanks.
5 MS. RADEL: The VTS safety actuation is 6 initiated based on process variables indicating that 7 a break in the process boundary has occurred in either 8 the subgrade or the hot cells, and this actuation is 9 provided to limit the radiological release in that 10 event.
11 It terminates the vacuum-lifting 12 operations by opening the breakers to the vacuuming 13 pumps, and also opening vacuum relief valves. It also 14 isolates the chemical reagent lines that penetrate the 15 confinement boundary.
16 The TPS train isolation is initiated based 17 on process variables indicating a breach of the 18 tritium boundary within an IU cell, the supply return 19 lines, or the TPS glove box.
20 It isolates the TPS glove box, closes the 21 tritium room dampers, and initiates the IU cell TPS 22 actuation, which isolates the TPS lines into and out 23 of the IU cell.
24 The TPS process vent actuation is 25 initiated based on process variables indicating high NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
144 1 tritium in the process exhaust out of the tritium 2 systems, encloses the tritium process exhaust valves 3 from all trains, and initiates an IU cell TPS 4 actuation, which isolates the TPS lines into and out 5 of the IU cell.
6 The IU cell nitrogen purge is initiated 7 based on the discrete signal from TRPS, indicating 8 loss of hydrogen recombination capability in one or 9 more of the IU cells, or indication of loss of 10 external power following three-minute time delay.
11 It opens the nitrogen purge system, or 12 N2PS, IU cell header valves, and the N2PS valves to 13 the individual IU cells are actually opened by the 14 TRPS. So, these functions work together.
15 The RTS nitrogen purge is initiated based 16 on process variables indicating loss of flow in the 17 process vessel vent system.
18 It opens the N2PS RPF header valves, and 19 opens the PVVS carbon guard bed bypass valves. This 20 is done in case the loss of flow was due to a plug or 21 obstruction in that guard bed system.
22 The MEPS heating with isolation is 23 initiated based on process variables indicating a leak 24 of target solution into the MEPS heating route or a 25 break in the process boundary, either in the subgrade NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
145 1 or in the hot cells.
2 It closes the isolation valves for the 3 MEPS heating loop and opens breakers for the MEPS 4 extraction column feed pump.
5 The extraction column and IXP alignment 6 actuation is initiated based on process variables 7 indicating a valve alignment that could lead to 8 fissile material in a non-favorable geometry tank. It 9 aligns the valves to a safe position and is a 10 criticality safety control.
11 The dissolution tank isolation is also a 12 criticality safety control that is initiated based on 13 process variables indicating an overflow of the target 14 solution preparation system dissolution tanks, 15 potentially leading to fissile material in a non-16 favorable geometry location.
17 It isolates the tank inlets and outlets, 18 and isolates the cooling waters up high and return to 19 prevent additional water intrusion.
20 Moving to the monitoring variables in 21 response, on the exhaust radiation we have a High RVZ1 22 and High RVZ2 RCA exhaust radiation, which protects 23 against contaminant leakage, or accidents that could 24 potentially result in excess radiation dosage to the 25 workers or to the public. It's initiated when two out NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
146 1 of three or more signals are active.
2 The High RVZ1 supercell exhaust 3 ventilation radiation on the PVVS hot cell protects 4 against hot call equipment leakage or an accident that 5 could potentially result in excess radiation doses to 6 workers or the public.
7 Supercell isolation Area One is initiated 8 off of the signal, as well as the VTS safety 9 actuation, when two out of three or more signals are 10 active.
11 The High RVZ1 supercell exhaust 12 ventilation radiation for the MEP's extraction hot 13 cells again protects against hot cell equipment 14 leakage, or an accident that could potentially result 15 in excess radiation doses.
16 It initiates supercell isolations to the 17 affected area, the affected extraction cells, MEPS 18 Heating Loop Isolation and VTS safety actuation, when 19 one out of two or signals are active.
20 Continuing with exhaust radiation, there's 21 High RVZ1 supercell exhaust ventilation radiation on 22 the IXP hot cell, again protecting against excess 23 radiation doses.
24 The supercell isolation area ten, which is 25 an IXP cell, and the VTS safety actuation, are NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
147 1 initiated when one out of two or more signals are 2 active.
3 High RVZ1 supercell exhaust on the 4 purification and packaging hot cells again protects 5 against excess radiation doses, and will isolate the 6 affected area of the supercell on a one-out-of-two or 7 more signals being active.
8 MEPS and IXP, High MEPS Heating Loop 9 Isolation protects against leakage of high radiation 10 solutions and to the heating water loop, which is 11 partially located outside the supercell shielding and 12 could potentially result in excess dose to workers.
13 It initiates a MEPS Heating Loop Isolation 14 of the affected loop when one out of two or more 15 signals are active.
16 MEPS Area A, B and C three-way valve 17 position indication protects against the misalignment 18 of the extraction column upper and lower three-way 19 valves, which is criticality safety control and 20 initiates an extraction column alignment actuation 21 when two out of two signals are active.
22 The IXP three-way valve position 23 indication protects against a misalignment of the 24 upper and lower three-way valves, which would degrade 25 barrier of the preventing misdirection, similar to the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
148 1 MEPS, and it initiates an IXP alignment actuation when 2 two out of two signals are active.
3 Okay, the PVVS, VTS and RDS variables. We 4 have the high PVVS carbon delay bed exhaust 5 temperature, which protects against fire in the PVVS 6 delay beds. It initiates a carbon delay bed isolation 7 of the affected bed when one out of two or more 8 signals are active.
9 Well PVVS flow protects against loss of 10 hydrogen mitigation capabilities in the RPF and 11 initiates an RPF nitrogen purge when two out of three 12 or more signals are active.
13 The VTS vacuum header liquid detection 14 protects against an overflow of the vacuum lift tanks, 15 to prevent a potential criticality event. The VTS 16 safety actuation is initiated when one out of two or 17 more signals are active.
18 And then, the RDS liquid detection detects 19 leakage or overflow from other tanks and piping, and 20 initiates a VTS safety actuation when one out of two 21 or more signals are active.
22 For the tritium systems, we monitor for 23 high TPS IU cell target chamber exhaust pressure or 24 supply pressure, and this is individually monitored on 25 each of the eight IU cells.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
149 1 This protects against a break in the 2 tritium exhaust for supply lines, as well as if there 3 were a breach in the neutron driver pressure boundary 4 that would release tritium into the IU cell or the 5 transfer area between the tritium system and the IU 6 cell. This would initiate a TPS train isolation for 7 the affected train and an RCA isolation, when one out 8 of two or more signals are active.
9 High TPS exhaust to facility stacked 10 tritium protects against the release of tritium from 11 the TPS glove box pressure control exhaust and back 12 ITS process, vent exhaust into the facility 13 ventilation systems, it initiates a TPS process vent 14 actuation when two out of three or more signals are 15 active.
16 High TPS confinement tritium, and this is 17 provided on each train of the tritium equipment, 18 protects against a release of tritium from TPS 19 equipment and its associated TPS glove box.
20 It initiates a TPS train isolation for the 21 affected train and an RCA isolation when one out of 22 two or more signals are active.
23 And one more slide, monitor variables.
24 Lots of monitor variables in slide.
25 So, we have the TRPS IU cell nitrogen NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
150 1 purge. This is a discrete signal coming from the TRPS 2 for each individual IU cell. It protects against the 3 loss of nitrogen mitigation capabilities in the 4 irradiation units, and initiates a IU cell nitrogen 5 purge.
6 The TSPS target fission preparation system 7 dissolution tank level -- and there's two different 8 dissolution tanks with level instrumentation, where it 9 protects against a criticality event, leaving access 10 for cell material and non-capable geometry system, and 11 initiates a dissolution tank isolation when one out of 12 two or more signals are active.
13 The UPSS loss of external power protects 14 against an anticipatory loss of hydrogen mitigation 15 capability in the IU cell, loss of the TOGS blowers 16 and heaters after the UPSS runtime of this equipment 17 is exceeded.
18 It initiates an IU cell nitrogen purge 19 when one out of two or more signals are active for the 20 180 seconds.
21 Any questions on the ESFAS safety 22 functions or monitor variables, before I turn to 23 priority logic? Okay.
24 Priority logic. The actuation priority 25 logic, or APL, is designed to provide priority of NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
151 1 safety-related signals over non-safety-related 2 signals.
3 Division A and Division B of TRPS ESFAS 4 priority logic prioritizes the automatic safety 5 actuation and APL safety actuation over any signals 6 coming from the PICS on safety-related controls 7 system.
8 When the enabled non-safety control is not 9 active, the non-safety-related control signals are 10 ignored by the TRPS and ESFAS. If the enabled non-11 safety control is active and no automatic safety 12 actuation or manual safety actuation command is 13 present, the non-safety control signal can control the 14 component.
15 MEMBER MARCH-LEUBA: Hey Tracy, this is 16 Jose. So, it's a little unusual to have signals that 17 ignore the control or non-control of safety and non-18 safety. You guys have reviewed that the safety 19 signals are never filtered. Correct?
20 MS. RADEL: Correct. The safety signals 21 are never ignored. This is just those PICS signals 22 coming in to reset the component. If there are no 23 safety actuations present, either automatic or manual, 24 then it allows PICS to reset the component for --
25 (Simultaneous speaking.)
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
152 1 MEMBER MARCH-LEUBA: This is kind of 2 equivalent to what we would call a hold, or a lock.
3 So, once you take, you're not allowed to reset the 4 breakers automatically. Yeah, this priority logic is 5 a little too complicated.
6 On reactors, what we've been doing in the 7 past, if you open a breaker and you let the control 8 rods in, the control system cannot possibly close it, 9 because it's locked.
10 MS. RADEL: Right. And that is true for 11 our system as well. You would need an operator action 12 then to reset that, and you would only be allowed to 13 perform that action if the system was no longer in a 14 trip condition, and that enabled non-safety switch was 15 turned.
16 MEMBER MARCH-LEUBA: And this logic is 17 equivalent to that. A little more sophisticated 18 maybe. Okay, that's fine. Thank you.
19 MS. RADEL: Okay. Communication between 20 TRPS ESFAS and PICS. This site covers the types of 21 information that is communicated. So, each division 22 of TRPS and ESFAS trains MEPS monitoring indication 23 and diagnostic information to PICS for display to the 24 operators.
25 PICS provides mode transition signals to NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
153 1 TRPS when manually initiated by the operator. PICS 2 provides valve and damper position indication to the 3 TRPS and ESFAS for verification of completion of 4 protective function, and PICS provides signals to TRPS 5 ESFAS, to reposition components when they're manually 6 initiated by operators, and the enabled non-safety 7 switch is in the enabled position.
8 The ways that this communication occurs 9 are noted on the last slide here. Communication from 10 the TRPS ESFAS to the PICS is via serial connection, 11 via MODBUS RTU protocol.
12 Communication from the PICS to the TRPS 13 ESFAS is via a series of discrete contacts which 14 communicate a series of addresses that are correlated 15 to inputs and non-safety control signals, and all 16 interfacing between TRPS ESFAS and the PICS is by the 17 gateway communication module, which Jason touched on 18 earlier.
19 That's the last slide. Are there any 20 additional questions on TRPS or ESFAS? Thank you.
21 CHAIRMAN BALLINGER: Okay, that concludes 22 the SHINE presentations for today, is that correct?
23 Except for the closed session.
24 MR. BARTELME: No. This is Jeff Bartelme.
25 We still have a session on safety-related radiation NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
154 1 monitoring and --
2 (Simultaneous speaking.)
3 CHAIRMAN BALLINGER: Ahh. Sorry, sorry.
4 MR. BARTELME: We're bringing those slides 5 up now.
6 CHAIRMAN BALLINGER: Got it.
7 MEMBER BROWN: Ron, this is Charlie.
8 CHAIRMAN BALLINGER: Yes, sir?
9 MEMBER BROWN: Let me get back to what I 10 can see here. SHINE. The closed-session slides are 11 just pictures of the detailed, eyeball-piercing logic 12 diagrams.
13 CHAIRMAN BALLINGER: Okay, yeah.
14 MEMBER BROWN: You can take a look at 15 that. I'm just giving you a heads, I'm not sure this 16 is going to add much value for the members, unless 17 they want to see it.
18 CHAIRMAN BALLINGER: All right. Well, 19 we'll get a chance to ask that question.
20 MEMBER BROWN: Yeah, I'm just bringing it 21 up to you so you have it ahead of time. That's all.
22 CHAIRMAN BALLINGER: Yeah, I was looking 23 at them also.
24 MR. BARTELME: This is Jeff Bartelme from 25 SHINE. We have not prepared any presentation material NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
155 1 for closed session. But because so much of that 2 content did contain proprietary and export-controlled 3 information, we just wanted to put them into a slide 4 deck that if we had any sort of specific information 5 to share to them, or any questions which we need to 6 refer to them, we wanted to have them available in a 7 presentation for closed session.
8 CHAIRMAN BALLINGER: Got it. Thank you.
9 Thank you. Okay, onward and upward.
10 MR. WATTSON: Sure. Okay, this is Bill 11 Wattson, the INC manager. Because of the earlier 12 problems. Can everybody hear me okay now?
13 CHAIRMAN BALLINGER: Yeah, whatever you're 14 saying, about half of your sentence sounded like you 15 were far away, and the rest of it sounded like you 16 were close and very good. So, I don't know what 17 you're doing.
18 MR. WATTSON: Okay, does it sound okay 19 now, Carl?
20 CHAIRMAN BALLINGER: Sounds okay to me.
21 It depends on the reporter. Okay, good.
22 MR. WATTSON: Okay, good deal. Great.
23 Well, I'm here to present on the safety-related 24 radiation monitoring and the neutron flux detection 25 system.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
156 1 The rad monitors are for fission products 2 and tritium, and are both inputs to the ESFAS and TRPS 3 system. The fission product monitors are comprised of 4 beta particle gas-use monitors, and gamma monitors 5 for the MEPS water overloads.
6 The beta simulators provide their inputs 7 to both TRPS and ESFAS, whereas the gamma monitors are 8 to ESFAS only.
9 Tritium monitors monitor the various 10 points in the tritium processing system, providing 11 their inputs to ESFAS, and the rad monitor information 12 is displayed in the control room on the operator 13 workstations via the PICS system. Next.
14 Fission product radiation monitors. The 15 RVZ1 supercell PVVS exhaust monitors, comprised of 16 three channels, A, B and C, provided to ESFAS, the 17 RVZ1 supercell extraction, purification and packaging 18 exhaust ventilation monitors are to ESFAS channels per 19 each area, and the RVZ1 and RVZ2 RCA exhaust monitors 20 are comprised of three channels for each to the ESFAS 21 system.
22 The fission product-produced monitors 23 continue in the RVZ1 exhaust subsystem, or RVZ1E.
24 PCLS expansion tank exhaust vent monitors detect 25 elevated levels of radiation from the IU PCLS NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
157 1 expansion tank exhaust, and they are comprised of 2 three channels each provided to TRPS per expansion 3 tank. And then, the MEPS hot water loop monitors, or 4 gamma monitors, with two ESFAS channels provided for 5 each of the water loops.
6 Tritium monitors, or TPS tritium 7 confinement atmosphere monitors, are provided with two 8 channels per glove box, signaling to ESFAS.
9 TPS exhaust to facility-stacked tritium 10 monitors detect tritium in the RVZ1E exhaust, and 11 that's comprised of three channels. And they're also 12 signaling to ESFAS.
13 And in conclusion, and interfacing with 14 TRPS and ESFAS, there are analog inputs to both 15 systems. The safety actuations occur when the input 16 value exceeds the predetermined set point, the point 17 being is that the set point determination is done by 18 the safety system.
19 And that concludes the brief presentation 20 on safety-related radiation monitoring. Do you have 21 any questions before I proceed?
22 Okay, Neutron Flux Detection System, or 23 NFDS. The NFDS monitors an (unintelligible) neutron 24 flux, determined multiplication factor and power level 25 during the filling in the TSV and the irradiating and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
158 1 the target solution.
2 The NFDS monitors variables and important 3 safety functions of the irradiation units, provide 4 input to the TRPS performance safety functions. The 5 signals provided the PICS for main control room 6 indication, to cover the entire range of neutron flux 7 levels in three different ranges, the source range, 8 the wide range, and the power range.
9 The NFDS is a three-division system, with 10 six detectors positioned around the subcritical 11 assembly support structure, at approximately 120-12 degree intervals to the TSV.
13 MEMBER BROWN: Before you switch slides?
14 MR. WATTSON: Sure.
15 MEMBER BROWN: I'm looking at the diagram.
16 Does this provide its data and information to the PICS 17 via the same path that TRS -- come on, I'm going to 18 get it right here -- TSRP system does? TRPS, rather?
19 The data shows like it goes into the 20 various -- for the TRPS system it goes into the 21 various SFMs. And does that then goes out via the 22 MSEM and the other gateways and everything else? Is 23 that how it goes into the PICS? It doesn't go 24 directly --
25 MR. WATTSON: Yes, it is. The signal NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
159 1 comes in to TRPS, and then it's related to PICS for 2 display.
3 MEMBER BROWN: Okay. All right, that's 4 all I needed to know. Make sure it's got the same 5 isolation. That's all, thank you.
6 MR. WATTSON: Sure.
7 MEMBER MARCH-LEUBA: This is Jose. I do 8 have a question about, apparently there is only one 9 detector for the power and wide, and it's shared? Is 10 it the same head unit but two different electronics?
11 MR. WATTSON: Yeah, it's a compensated ion 12 chamber. It actually covers both the power range and 13 the narrower band and the wide range to give it the 14 overlap with the source range detector.
15 MEMBER MARCH-LEUBA: But it is the same 16 ion chamber for both power and wide?
17 MR. WATTSON: Yeah, the same CIC. That's 18 correct.
19 MEMBER MARCH-LEUBA: So, you're only 20 changing the electronics?
21 MR. WATTSON: Yes.
22 MEMBER MARCH-LEUBA: So, I'm assuming the 23 wide range is pulse counting and the power is what 24 they call current?
25 MR. WATTSON: No. Actually wide and power NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
160 1 range are current. Only the source range uses pulse 2 counting.
3 MEMBER MARCH-LEUBA: So, you're using just 4 a different scale, but same detector, same counting 5 method? I mean, I don't see the different between 6 power and wide, from what you're telling me.
7 MR. WATTSON: Sure. I think it's more a 8 matter of resolution. The wide range is -- I guess 9 maybe a construct way to think about it, yeah, it's 10 almost more like a long-scale -- well, actually, I 11 think about like control on panels on like trigger 12 reactors.
13 You have the long-scale pen, which covers 14 the entire range of power, and then the linear scale 15 for basically power range operation in finer 16 increments.
17 MEMBER MARCH-LEUBA: So, the sensitivity 18 of the detector, because the next question I want to 19 ask you, see do you know what the dead time, pulse 20 pileup issues. If you are including the pulse pileup, 21 probably will make a difference. But dead time is 22 probably either.
23 When you have a detector that has more 24 sensitivity to cover a wide range, you end up always 25 having problems with dead time and pulse pile-up, and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
161 1 all that stuff.
2 MR. WATTSON: Yeah, dead time and pulse 3 pile-up isn't a fact of a pulse rate-type detector.
4 These are ionization chambers. So, they're measuring 5 current.
6 MEMBER MARCH-LEUBA: (Unintelligible) 7 pulses. They just pile them up and create a current.
8 You can count the pulses in an ion chamber. Okay, I 9 still don't understand how out of the same physical 10 sensor here, you get two different ranges. But I 11 guess you guys know how to do it. I'm surprised.
12 MR. WATTSON: Actually, the detector 13 design that's pretty established -- well, I have my 14 SRO and trigger reactor 40-something years ago, and 15 basically, exactly the same detector configuration.
16 It effectively used a fission chamber of the source 17 range detector.
18 Now, that is also an ion chamber, but it 19 generates pulses because the fission event is so 20 significant to the current output in chamber, it's 21 effectively a pulse.
22 But the normal operation of the even the 23 source range is to put out a constant current 24 associated with leakage current in operating in the 25 ionization range, and the compensated ion chamber is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
162 1 essentially always an ion chamber. It's basically 2 compensating for the gamma contribution from secondary 3 chamber.
4 MS. RADEL: This is Tracy. I do want to 5 clarify that we did discuss how the design changed to 6 move this sort of strange detector from the BF3 7 detector to a fission chamber recently, after the BF3 8 detectors failed some of their testing, and it was due 9 to gamma pileup issues, as the phase discussing that 10 can be an issue.
11 So, we are making the switch within the 12 licensing documentation and with the vendor, so 13 that'll be coming across in the Joy submittal.
14 MEMBER MARCH-LEUBA: So, this whole 15 advantage went to the fission detector?
16 MS. RADEL: Correct.
17 MR. JARROUJE: Which, that one is 18 completely independent from gamma. That's pretty 19 good. Okay, go ahead.
20 MEMBER BROWN: I'm surprised. You said 21 you had a problem with your gamma pileup with the 22 BF3s?
23 MR. WATTSON: Yeah, absolutely.
24 MEMBER BROWN: Geez. That's all I ever 25 used.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
163 1 MR. WATTSON: Yeah, I think part this --
2 MEMBER BROWN: Fission chamber is just 3 horrible to deal with. That's all.
4 MR. WATTSON: Yeah, of course. And, yeah, 5 if you want to get more into that --
6 (Simultaneous speaking.)
7 MEMBER BROWN: Well, it's your decision.
8 It's your decision.
9 MR. WATTSON: Okay. Are we done with this 10 slide?
11 MEMBER MARCH-LEUBA: Yes. Yes, we are.
12 MR. WATTSON: Okay, moving on. Okay, 13 let's talk about the source range detector. Source 14 range detectors with fissure low-flex levels common to 15 what would be expected during the filling of the TSV, 16 the NFDS provides TRPS with a count rate signal for 17 TRPS to perform its trip determination, and then the 18 TRPS initiates the IU cells, safety actuation, when 19 two out of three or more source range, or high source 20 range neutron flex signals, occur. Next slide.
21 The power wide-range detector. The power 22 wide-range measures, the flex levels and the ranges 23 that are expected when the neutron driver is 24 operating.
25 The power range neutron flex signal is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
164 1 input into the safety-related trip determination for 2 TRPS, and the TRPS initiates the driver dropout on 3 either a low power-range neutron flux, and initiates 4 IU cell safety actuation on high power range time-5 average neutron flux.
6 Wide-range neutron flux connects the gap 7 between the source range and the power range with 8 overlap, and is useful during both source and power 9 range levels.
10 The NFDS wide-range neutron flux signal is 11 input to the safety-related trip determination by a 12 TRPS, and the TRPS initiates IU cell safety actuation 13 on high wide-range neutron flux.
14 To cover the gap between source and power 15 ranges, the wide-range -- oh, you know, I've got to 16 repeat my slide, never mind, I'm sorry -- monitors the 17 flux levels between the source range and the power 18 range with the minimum of one decade of overlap, and 19 with a high end of the source range in two decades of 20 overlap, at the low end of the power range.
21 Detector calibration. The normal startup 22 count rate, or what we call NSCR here, is determined 23 by filling the TSV to approximately 95 percent of 24 critical-by-volume, with optimal concentration 25 solution at a stable temperature.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
165 1 The source range set point is then set 2 relevant to NSCR per technical specifications. The 3 drift allowance relied on by the source range set 4 point calculations is periodically checked using empty 5 TSV count rate. Final slide.
6 Detector calibration of the power wide-7 range detectors. Prior to filling a TSV for 8 radiation, a sample is taken from the associated 9 target solution, and the sample is analyzed for 10 activity to determine the volumetric activity of the 11 selector isotopes.
12 The TSV is then pulled using standard 13 startup procedure, and the TSV level is recorded to 14 determine the volume of irradiated solution.
15 Target solution's irradiated for 16 sufficient time to create activity levels of selected 17 isotopes sufficient for calibration.
18 Then, a sample of the target solution is 19 analyzed post-irradiation, to determine the volumetric 20 activity levels of the selected isotopes, post-21 radiation.
22 And finally, power level during the 23 irradiation is calculated based on the initial and 24 final volumetric activity levels of the selected 25 isotopes, indicated power history, and the TSV volume.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
166 1 This value is then used to calibrate the NFDS power 2 range and wide-range detectors. Are there any 3 questions on that?
4 MEMBER REMPE: So, this is Joy. And I 5 don't really have a question about that particular 6 slide, but I guess I want to explore a little bit 7 more. Didn't I hear someone say that, yes, we're 8 going to be modifying something with a submittal 9 that's coming in? And what exactly will be changed?
10 Will all of these changes to Section 7 coming up?
11 MR. BARTELME: This is Jeff, pardon me.
12 So, to account for the source range detector, 13 detecting only a fission chamber, there will be 14 modifications to Section 78 of the FSAR, to remove 15 that reference to the BF3 detector and provide 16 reference to the fission chambers.
17 MEMBER REMPE: So, when that revised 18 section comes in -- we saw a table, I probably have 19 the wrong digits on it if I tried to cite the number 20 right now, but I look it up before the staff come up, 21 but beside percentage of table -- and actually, part 22 of that table was even presented in the open section, 23 where they included the delays and some information 24 and references to other sections in the FSAR -- will 25 that table be included in the updated submittal on NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
167 1 Section 7? I can look up the table number while 2 you're trying to answer that's puzzling you, what I'm 3 trying to talk about here.
4 MR. BARTELME: No, the timing table, that 5 sort of compilation of information, is not something 6 we'll be incorporating into the licensing basis, and 7 it won't change with the change in the detector type.
8 MEMBER REMPE: Okay. So, I guess then, 9 the next question I have, and I'll be asking the staff 10 about it, is the audit and the progress that's going 11 on.
12 Because the backup slides indicate that 13 the audit still isn't done, with respect to some of 14 the timing and the delays, or whatever. There seems 15 to be some outstanding issues. But again, I'll wait 16 for the staff.
17 CHAIRMAN BALLINGER: Okay.
18 MR. WATTSON: Yeah, and that's the last 19 slide, so that concludes my presentation on rad 20 monitoring.
21 CHAIRMAN BALLINGER: Ah. Okay, thank you.
22 So, that is the last set of slides for this section.
23 Am I correct?
24 MR. BARTELME: It is, yes.
25 CHAIRMAN BALLINGER: Okay. The next NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
168 1 presentation is from the staff. We're not scheduled 2 for -- well, actually, we're scheduled for a break at 3 3:30, but we've been going at it for two hours, and 4 that presentation was pretty detailed.
5 So, I'm going to propose that we take a 6 break now. It sounds to me -- at least I'm getting 7 the impression that the closed sessions will be 8 shorter than listed.
9 So, let's take a break until -- now, let's 10 do it until 3:30. So, unless there are objections 11 from anybody, we'll recess until 3:30. Thank you.
12 (Whereupon, the above-entitled matter 13 went off the record at 3:09 p.m. and 14 resumed at 3:30 p.m.)
15 CHAIRMAN BALLINGER: Okay, speaking of 16 going two hours straight, we're about to go another 17 straight. We're back in session and we're ready for 18 the staff's presentation.
19 And I've discovered why it was so hard for 20 me to read chapter seven. The staff has six pages of 21 acronyms in the back of their slides. Anyway, okay.
22 MEMBER BROWN: I told them to put them 23 there because then you don't have to try to get back 24 to the chapter seven to find out what acronyms mean.
25 There's only about 22 acronyms. I forgot how many.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
169 1 There's just a ton of them. I can't even keep them 2 straight.
3 CHAIRMAN BALLINGER: Six pages.
4 MEMBER BROWN: Yes, the chapter itself.
5 MR. BALAZIK: This is Mike Balazik. Can 6 you see the slides?
7 CHAIRMAN BALLINGER: Yeah, we're fine.
8 MR. BALAZIK: Okay, got you.
9 CHAIRMAN BALLINGER: We'll have to get rid 10 of the -- we'll stop the levity. Okay, let's go.
11 MR. WATERS: All right, this is Mike 12 Waters. I'll start off. And don't fear, we're only 13 going to go through five of the six slides of 14 acronyms. I'm kidding.
15 My name is Mike Waters. I'm Chief, 16 Instrumentation and Controls Branch, NRC, and I'm 17 happy to be here today to introduce the review team 18 this hour which will brief you on the chapter seven 19 safety evaluation report.
20 So, the staff evaluations primarily 21 focused on electronic design of the SHINE I&C systems 22 in terms of its ability to achieve its intended design 23 functions for detecting potential upset conditions 24 and, of course, actuating safety system components to 25 put the facility into a safe configuration and NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
170 1 mitigate consequences as credited in the safety 2 analysis.
3 This slide shows the primary reviewers 4 that contributed to chapter seven SE. I'd also like 5 to note that the reviewers that have greatly 6 contributed to the I&C review. Those include Michael 7 Caul and Joe Staudenmeier among them.
8 The I&C team has coordinated closely with 9 them on the interface between the intended functions 10 of the I&C with ensuring safety features limits that 11 protect the facility against postulated events which 12 you've been briefed upon in previous events.
13 So, as you know, we're here today to 14 highlight aspects of our technical review, and given 15 the comprehensive discussion and the time, please feel 16 free to tell us where to fast forward or focus our 17 presentation here. Slide five, please, Michael?
18 Yeah, I just want to reiterate the scope 19 of the SE before you. We have completed our review of 20 the primary safety systems, TRPS and ESFAS, with the 21 exception of a few open items related to life cycle 22 development and technical specifications, and the 23 fixed design is currently under review, and, of 24 course, we'd be happy to engage later on these issues 25 as needed. Next slide, please?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
171 1 Yeah, this is for reference that may come 2 up in further discussion. This is a diagram from the 3 safety analysis report that provides an overview of 4 the overall I&C architecture for the facility.
5 It includes a TRPS and neutron flux 6 detection system for each iteration unit, the ESFAS 7 for the entire facility, and those associated modules 8 that operate on the HIPS platform.
9 Basically, the area is encompassed by the 10 green on these pictorials that are the focus of our 11 safety evaluation report and discussion today. Slide 12 seven, please?
13 And finally, before I hand it over to 14 Dinesh, at the highest level, a major focus of our 15 safety evaluation was independently confirming that 16 the I&C system satisfies those applicable facility 17 design criteria that are listed here.
18 As you heard this morning, the criteria 19 for I&C is the same or closely tracks to the general 20 design criteria in Part 50. Obviously, multiple 21 facility systems, structures, and components 22 contribute to satisfying each facility design 23 criterion, and, of course, chapter seven focused on 24 those I&C-related portions for those criteria.
25 And as you would guess, we had a higher NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
172 1 focus on certain criteria for our reasonable assurance 2 determination. Those include such things as criterion 3 13 for appropriate controls, criterion 15 for 4 reliability and testing, and criterion 16 for 5 independence, and well as criterion 18 for separation 6 of protection controls, as well as all the ones listed 7 here.
8 And just to close it out, the 9 (unintelligible) described how we applied the five I&C 10 fundamental design principles which extracted these, 11 including independence, redundancy, predictability, 12 diversity, and simplicity within our confirmatory 13 view.
14 MEMBER BROWN: Okay, don't go yet. If 15 you're ready to switch slides, let me ask a question.
16 MR. WATERS: I was about to turn it over 17 to Dinesh, but please go ahead.
18 MEMBER BROWN: This is Charlie. I forgot 19 to ask SHINE, if they're still on the line. I presume 20 they're still listening. When they were doing their 21 ESFAS part, I had tracked the design criteria between 22 TRPS and ESFAS and I found that the ESFAS has a design 23 criteria 18 which is not present for the TRPS.
24 And it was related to the no single 25 failure within the instrumentation or power concurrent NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
173 1 with failure as a result of design basis event. That 2 criteria is not in TRPS and I was wondering why, from 3 the power supply standpoint as it's explained down 4 below.
5 MR. BARTELME: We're still here. We'll 6 look into that. We can follow up.
7 MEMBER BROWN: Okay, I was just going 8 through the TRPS one, the one, two, three, four. I 9 got to 18 and 18 is now 19 in the ESFAS and there's a 10 new 18 in the ESFAS part. That's what triggered my 11 thoughts. So, anyway, put that on the plate. Go 12 ahead, Mike.
13 MR. WATERS: With that, I'll hand it over 14 to Dinesh to start out with the HIPS review.
15 MR. TANEJA: I hope you can hear me. Good 16 afternoon.
17 MEMBER BROWN: You're fine.
18 MR. TANEJA: Good afternoon, Professor 19 Ballinger, and all of the members of the subcommittee.
20 My name is Dinesh Taneja. I am the I&C technical 21 reviewer in NRR, the Division of Engineering and 22 External Hazards, ELTB branch, and I am responsible 23 for evaluating the SHINE implementation of the HIPS 24 platform and the ESFAS design.
25 So, you know, the TRPS and the ESFAS are NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
174 1 designed using the HIPS platform, and in the SHINE's 2 FSAR, they have incorporated the HIPS topical report 3 that we reviewed prior to looking at the NuScale 4 design, and we came in front of you with our topical 5 report prior to reviewing the NuScale.
6 And the 65 application-specific items, the 7 ASAIs that are identified in this topical report, they 8 were developed for the power reactors, and some of 9 those ASAIs do not apply to the SHINE facility, but 10 SHINE prepared this technical report, tech report 11 2018-0028, that provides dispositions to all of the 12 applicable ASAIs and also provided the explanation of 13 the architecture differences between what was in the 14 topical report, you know, which had the representative 15 four-channel system with, you know, diversity with two 16 different FPGA technologies, and some of the changes 17 that they've made to the modules, they are described 18 in this technical report.
19 So, as part of my review, I evaluated that 20 report and basically my conclusion was that the SHINE 21 architecture and the implementation still conforms 22 with the fundamental design principles that we 23 evaluated as part of its topical report, so it's 24 pretty consistent with what we have in the topical 25 report.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
175 1 So, it continues to meet the fundamental 2 principles of independence, redundancies, 3 predictability and repeatability, and the diversity 4 and defense-in-depth. Next slide, please?
5 So, you know, I guess SHINE covered the 6 key modification this morning. If you want, I can go 7 through them again, but basically, you know, we 8 reviewed them and we found them acceptable.
9 So, it's just a remote input submodule 10 which basically takes one of the ISMs for the SFM, you 11 know, module. You know, these are the four submodules 12 on the safety function module and they remodeled it 13 for the neutron flux detection.
14 And, you know, combining the ESP 15 (phonetic), the voting module and the scheduling 16 bypass module on one module, and they created these 17 gateway modules, you know, for doing the communication 18 with the HIPS platform.
19 And the other changes are, I think they 20 were described earlier this morning as well, so in the 21 topical report, the hardwire input module signals were 22 directed to certain modules and the SHINE application, 23 they made those signals available on the back frame of 24 the chassis, so any logic that needs that input, it 25 can utilize that.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
176 1 And also, the EIM outputs, you know, now 2 it drives eight components, so the way it's grouped in 3 now, you know. In the topical report, we were driving 4 four components off of each EIM module, this one 5 because all of the components are really not -- you 6 know, they are small-sized sunlight valves and all of 7 that, so they were able to drive, you know, eight 8 components off of one EIM module.
9 So, those are the key differences. Now, 10 if there are any questions, I can, you know, answer 11 those right now or I can move onto the next slide.
12 MEMBER BROWN: Move on.
13 MR. TANEJA: All right, next slide, 14 please? So, this figure comes out of the FSAR. It 15 just kind of shows the -- you know, this morning, they 16 were saying that there are nine cabinets with TRPS, so 17 this is your cabinet number one that has the IU cell 18 one and two chasses and then the maintenance 19 workstation in the middle of that.
20 So, this is just representing, you know, 21 one of the cabinets of the nine TRPS cabinets. I just 22 wanted to provide a pictorial view of that. Next 23 slide, please?
24 So, one thing that we did not have in the 25 topical report, I guess we had that as an ASAI, was NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
177 1 the environmental qualification of the actual, you 2 know, equipment, so we evaluated the report, EQ 3 report.
4 So, that EQ report basically demonstrated 5 that the seismic qualification meets the requirements.
6 It was tested for EMI/RFI qualification in accordance 7 with Reg Guide 1.180, and it was subjected to, you 8 know, these environmental conditions which is 9 classified as a mild environment in accordance with 10 the IEEE standard 623-2003 version, which basically 11 verified that these equipment can work continuously at 12 140 degrees Fahrenheit and there is no -- you know, 13 it's a passive cooling, so there is no forced cooling 14 in the cabinets, and it has limited operational 15 capability at an exterior temperature of 158 degrees 16 Fahrenheit. So, we did review that, you know, and I 17 guess it was an audit of the EQ documents for this 18 equipment. Next slide, please?
19 So, it's just, I think, in words I'm 20 saying basically the makeup of the TRPS and ESFAS 21 architecture. You know, even though it's using feed 22 channels, the basic architecture is essentially the 23 same. That is that, you know, each channel is triple 24 module redundant.
25 It has three safety buses and, you know, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
178 1 it has three, the SBMs and three voting modules. So, 2 each of these receive a voted input and then three 3 signals go out to the EIMs, which again get voted, so 4 it's the same concept that's in the topical report.
5 So, there is only one-way interdivisional 6 communication and there's a one-way data communication 7 going out to PICS while the M&I communication module.
8 So, this one is, you know, I think, Charlie, you were 9 mentioning those red lines.
10 So, the red lines, you know, are the 11 communication from the M&I CB, you know, communication 12 module, the monitoring and indication, maintenance and 13 indication communication module buses that goes out --
14 (Audio interference.)
15 MR. TANEJA: Slide, please? The next? Go 16 to the one over? I can talk about that and we can 17 come back to that. So, Charlie, this figure we 18 received as part of the RAI response. Now, this 19 figure shows the gateway modules and how they are 20 actually, you know, implemented in the TRPS and ESFAS 21 design.
22 So, each of the TRPS, you know, channels, 23 and each of the ESFAS channels provides input to these 24 specific modules, and then they are combined together 25 before they go out to the PICS.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
179 1 So, it's all one-way communication, so 2 basically each of the RS-485 modules, they have three 3 ports configured as input only and then one port is 4 configured that's talking to the PICS as a two-way, so 5 it really does provide us the isolated output coming 6 out of the, you know, TRPS and ESFAS cabinets into 7 that, and it has --
8 You know, this was one of the questions 9 that we were asking. What happens if I lose this 10 interface and if I lose the indication in the PICS?
11 So, their implementation is doing the redundance out 12 of inputs to provide reliability of PICS displays of 13 all the information that's available in the TRPS and 14 ESFAS. So, if we can go back to the slide, please?
15 We were on, I think, the one before, let's see. Yeah, 16 this is it.
17 MEMBER BROWN: Thirteen.
18 MR. TANEJA: Yeah, so slide 14, please?
19 All right, so, you know, the fundamental design 20 principle of independence, and so here, I think we --
21 we received this thing, you know, pretty thoroughly, 22 and there were the independence single failure 23 criteria.
24 So, we audited a couple of the documents 25 and they were the ESFAS TRPS single failure analysis NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
180 1 report and the failure most in effect analysis report 2 to basically confirm the single failure criteria and 3 redundancy arguments and the independence arguments of 4 this whole design.
5 And then we looked at the T3 assessment of 6 the TRPS and ESFAS, diversity and defense-in-depth 7 assessment technical report, and we audited that 8 report to basically confirm that this report verified 9 that there is adequate diversity in the system.
10 And this assessment was performed using 11 the, you know, our NUREG, what is that, 93-0? We kind 12 of mixed up that number, let's see. Yeah, it's the 13 NUREG CR that we have on T3 assessment is what they 14 used to really model this diversity analysis and 15 assessment on.
16 So, we evaluated that and we came to a 17 conclusion that it had adequate diversity and, you 18 know, and it basically met the SHINE design criteria 19 19 which talks about the high probability of 20 accomplishing their safety function in the event of 21 anticipated transients, and the protection system 22 independence requirements and the single failure 23 criteria, you know, they meet the SHINE design 24 criteria 15.
25 So, on the access control element, you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
181 1 know, the interfaces that we have from the TRPS or the 2 ESFAS, so all of the access control features that are 3 discussed in the topical report are being implemented 4 here.
5 That is that you cannot change any logics 6 on any of the cards unless you pull them out of the 7 circuit, and also to changing any set points, you have 8 to take the card, you know, and put it in a bypass.
9 Take it out of service and then you have to physically 10 enable an input before a maintenance workstation can 11 make a change to a set point. So, those features are 12 identical to what we reviewed as part of the topical 13 report.
14 And so, they actually do not have any --
15 the only other communication that's coming into the 16 TRPS and ESFAS is the hardwired inputs from the PICS.
17 So, those are -- there are no data communication 18 happening. They are coming through the isolated 19 contacts on the hardwired input modules.
20 And then the priority scheme that they 21 talked about this morning which is, you know, the APL 22 logic, which is implemented in the equipment interface 23 module using discrete components, and there is no FPGA 24 or any of that used in there.
25 So, those inputs handle the manual system NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
182 1 level actuations, and that provides another diversity 2 element. So, you can provide manual actuations in the 3 case and that basically protects us against the 4 potential common cause failures on the software side.
5 And any inputs coming in from the non-6 safety, which is PICS, you have to actually, you know, 7 enable that input before you could actually take 8 access of any of the components, so that's like a 9 component-level control from PICS that is done, you 10 know, administratively using the enable feature, which 11 is also identical to what we reviewed in the topical 12 report.
13 Completion of protective actions, so all 14 of the designs, all of the logic diagrams we looked 15 at, all of these safety functions, once initiated, 16 they basically go to completed, you know, completed 17 action and they are sealed in, and everything is a 18 failsafe design, so they go to a safe state on loss of 19 power or on fault, any given fault.
20 You know, if it is a fatal fault detected, 21 it would put the output in a safe state. If it is a 22 fault where the safety function is not impacted, then 23 it would just simply alarm that there is a fault that 24 needs attention, so the same design principles that 25 were discussed in the topical report, you know, the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
183 1 different levels of faults, and how they are 2 identified, and how they are treated.
3 All right, next slide, please? Okay, we 4 talked about that one. Diagnostics and self testings, 5 they talked about that this morning.
6 Operational and maintenance bypasses, so 7 all of the operational bypasses are automatic. They 8 are in the TRPS system. There are no operational 9 bypasses in the ESFAS.
10 And the maintenance bypasses are 11 controlled via the tech specs, basically making sure 12 that we have minimum redundancy available, so they 13 only take out -- there's administration controls in 14 the tech specs that only allow us to take out one 15 safety function module in a given division at a time 16 and not take out the redundant one on the companion 17 division.
18 We talked about all of the manual 19 actuation. So, there is a set of, you know, system-20 level manual actuations which are safety related, and 21 then you have capability to actuate components using 22 PICS via the, you know, the enable feature in the TRPS 23 and ESFAS.
24 Response times, regulated limits, and set 25 points. Now, in tables 741 and 751 of the FSAR, so NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
184 1 what we have there is the sensor response times given 2 and analytical limits are specified.
3 Now, we audited a couple of calculations, 4 set point calculations, and the set point calculations 5 do a pretty good job of, you know, providing the basis 6 of the analytical limit and how they arrived at those 7 things, and the response times are, essentially 8 accounts for the --
9 You know, so the 500 millisecond response 10 time is allocated to the HIPS equipment. That is, you 11 know, from the sensor input to all the way to the 12 output, going out to the output device.
13 So, the sensor response time is in the 14 table, 500 milliseconds is allocated to the HIPS, and 15 then there is the response time of the actuated 16 component.
17 So, that combined total is accounted for 18 in the set point calculations, and the set point 19 calculations are performed using a methodology which 20 essentially follows the ISA standards, so it's a 21 pretty standard methodology, and these calculated 22 calculate the total loop uncertainty and they select 23 the set points, and those set points are used as the 24 limiting safety system settings in the tech specs.
25 But we are still evaluating some of those NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
185 1 calculations as part of the tech spec review that we 2 are still underway, and that's being done still, 3 continuing to be done. Next slide, please?
4 So, you know, so basically the conclusion 5 is that, you know, we reviewed the HIPS platform 6 implementation, you know, and we reviewed all of the 7 application-specific action items, you know, how they 8 were dispositioned, and we looked at the topical 9 report areas and which areas specifically, like the EQ 10 wasn't done back when we reviewed the topical report.
11 It was just an action item, so that was definitely 12 looked at.
13 The EMI/RFI testing, you know, it was an 14 action item and we looked at that, and we looked at 15 all of these, you know, features which are essentially 16 providing us assurance of these, you know, fundamental 17 principles of the I&C design, which is, you know, it 18 continues to maintain those independence, redundancy, 19 predictability, and repeatability, and D-3 concepts in 20 the design, and we found that the HIPS implementation 21 meets design criteria 15, 16, and 19.
22 So, those are the review of the HIPS 23 platform. I think the next slide, we are going to 24 talk about -- next slide, please? Yeah, it's the TRPS 25 review, so I'm going to turn it over to Norbert Carte NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
186 1 to take over the TRPS review, and then I'll come back 2 and I'll talk about the ESFAS review. If there is any 3 questions on the HIPS platform implementation, I can 4 take those right now.
5 MEMBER BROWN: I guess we're good to go.
6 Thank you, Dinesh.
7 MR. TANEJA: All right, Charlie. So, 8 Norbert, it's all yours.
9 MR. CARTE: Thank you. Hi, my name is 10 Norbert Carte. I'm a senior I&C technical reviewer at 11 NRR. Next slide, please?
12 So, I wanted to talk a little bit about 13 the philosophy of the review. So the design criteria 14 in chapter three and which are translated into chapter 15 seven are essentially the performance objectives. So, 16 if you perform those performance objectives, then you 17 have reasonable assurance of adequate safety. And 18 SHINE did that or discussed that in chapter three by 19 showing how they meet their safety criteria.
20 So, the next level down is -- now, with 21 SHINE, SHINE has a lot of design criteria in the FSAR.
22 They're not all equally important. Some are more 23 safety significant than others and we focused our 24 review on the safety significant ones such as 25 independence.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
187 1 Anyway, the next level down in this design 2 hierarchy is basically the design bases, which are 3 effectively functions and values. So, a safety 4 analysis report has an analysis that shows that if the 5 functions are performed at these values, then the 6 design criteria are met.
7 So, what happens is what we have done or 8 completed so far is we have looked at the design 9 criteria, if the design basis and functions are 10 consistent with those functions assumed in other FSAR 11 chapters and meet the design criteria. The values 12 essentially are set points, response times, and ranges 13 of instruments.
14 Since we haven't looked at the instruments 15 in detail, what we've seen in the set point 16 calculations and in the FSAR -- well, the FSAR has 17 analytic limits. The tech spec will have limiting 18 safety system settings.
19 We have looked at those, but that's under 20 review and discussion, and those numbers may or may 21 not change based on some of the audit discussions 22 we've had.
23 So, what we will eventually do in a 24 thread, or we should eventually do in a thread audit 25 is pull the thread all the way through. In other NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
188 1 words, look at the values assumed in the safety 2 analysis in chapter seven, so, I mean, 13. They're 3 not in 13. They're in underlying calculations.
4 Our reviewer in that area did look at 5 those things, but we will then trace that into the set 6 point calc where the analytic limit is adjusted for 7 all the uncertainties.
8 We should trace the uncertainty budget in 9 the set point calculation to the actual instruments to 10 ensure that they can reasonably assure those budgets.
11 What we've seen in the calculations are reasonable 12 numbers, not the necessarily actual numbers for actual 13 pieces of equipment that we've seen.
14 The one number that I think is probably 15 the most important is the set point. The response 16 time, with 500 milliseconds on an FPGA-based system, 17 that's actually a very, very generous response time.
18 It's very slow.
19 I haven't seen the specific processors or 20 what they're doing, but 500 milliseconds is very slow 21 because these things can perform the calculations in 22 parallel and can have response times on the order of 23 two milliseconds. So, I'm not sure why it takes 500 24 milliseconds, but we'll look at that in detail. Next 25 slide, please?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
189 1 So, what I wanted to talk a little bit 2 here about is some architectural things. What didn't 3 get emphasized is if we look at these, those top green 4 boxes, the singular ones, there's a little white box 5 and it has an arrow out to PICS.
6 Well, if you get out your magnifying glass 7 and you look at the text inside that little white box, 8 it says TX, so that's a transmit only box and that 9 gives us our -- it's a communication module, a 10 communication port configured as transmit only. That 11 gives us our one-way isolation.
12 In addition, you have the gateway which 13 also has a receive only, which the transmit only port 14 is connected to a receive only port, which is 15 additional isolation, but this is where we achieve our 16 isolation.
17 When we talk about configurable 18 parameters, you'll see there is this white box, 19 maintenance workstation, that has a dotted line. You 20 turn a key and make a connection in order for the 21 received port on the green module to be connected to 22 the send port in the maintenance workstation, so you 23 have to actually make a connection.
24 So, between those two features effectively 25 have translated electronic control of access features NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
190 1 into a physical control of access issue. You have to 2 use controlling access to the key.
3 You have to remove the cards to reprogram 4 them. You control access to the physical cards and 5 that's basically how TRPS addresses digital 6 communications.
7 Now, there's one other thing that comes 8 up, what you saw on 741 that you don't see here.
9 Actually, I'm having trouble reading it. There is an 10 input to the gray box from the control room.
11 So, the manual controls do come across in 12 a multiplex signal, but it's very discrete 13 multiplexing, and in a sense, the signal comes across 14 as a binary word. Part of that word is the address.
15 It's parity checked. It's complemented and parity 16 checked, so there's a lot of assurance on that.
17 Shoot, I wonder if I'm going too far.
18 Also then there's the command to what to 19 actuate, and again, they've talked about the priority 20 logic a little bit. That command can only happen 21 under two conditions. There is no either automatic 22 safety actuation or there is no -- and the enable 23 switch is in the correct position.
24 So, those gives us our control of access 25 and independence criteria. There's also independence NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
191 1 between the divisions, which is also done by some, I 2 guess, pink lines on this diagram. Again, that's 3 through send and receive ports on the SBMs or SBVMs.
4 Next slide, please?
5 So, the other thing that happens is that 6 the TRPS is mode dependent and it has a mode 7 dependency in part to enable and disable operational 8 bypasses automatically.
9 So, there is no -- so in some function, in 10 some modes, some functions are not needed. They are 11 automatically disabled when they are not needed and 12 automatically enabled when they are needed, so there 13 is no operator initiated operational bypass.
14 Maintenance bypass can be performed on 15 individual modules or components and it's not 16 disabling the whole function across all three 17 divisions. It's disabling or being able to work on 18 one component.
19 There is a maintenance bypass feature that 20 can be either put in trip, for instance, in a two out 21 of three system, or it can be put in a bypass state 22 for a one out of two system. Therefore, you can 23 perform maintenance on the sensor, NSFM function 24 module, without actuating a protective function.
25 The use of that maintenance bypass is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
192 1 discussed in the tech specs, but we'll look at tech 2 specs later, but there is a very restricted and 3 limited use on when you may bypass a signal for 4 testing or maintenance purposes.
5 MEMBER MARCH-LEUBA: This is Jose. When 6 you put a channel on bypass, what happens to the 7 voting logic? Is it still two out of three --
8 MR. CARTE: Well --
9 MEMBER MARCH-LEUBA: -- or is it one out 10 of two?
11 MR. CARTE: Effectively you're either 12 putting the channel -- you can put it in two --
13 there's two switches. One --
14 MEMBER MARCH-LEUBA: If you put it on 15 three, then --
16 (Simultaneous speaking.)
17 MR. CARTE: Right, right, right, one is --
18 there's two switches. One switch is an out of service 19 switch and the other -- which it's in service or out 20 of service.
21 And if you're in the out of service 22 position, then the indication on the other switch 23 matters, and that indication is either tripped or 24 bypassed, so, and that tripped is either an open 25 signal or a closed signal basically.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
193 1 It's not really changing the voting logic.
2 It's driving the signal to be a particular state, 3 which effectively changes the voting logic. So, a two 4 out of three signal with one signal in a tripped 5 position is effectively a one out of two signal.
6 MEMBER MARCH-LEUBA: That's obvious, but 7 what happens if you put it on bypass?
8 MR. CARTE: The --
9 MEMBER MARCH-LEUBA: Would you need a two 10 out of two?
11 MR. CARTE: Yes, you would need a two out 12 of two. That can be used for -- there's certain 13 systems like ESF that is basically always required to 14 be operable, and so you, and you will need to do some 15 testing, and some of those functions in ESF has two 16 inputs and it's a one out of two logic to accomplish 17 the single failure criteria.
18 Therefore, in order to do maintenance or 19 test those particular functions, you must put it in 20 bypass. The current tech spec says two hours in order 21 to do that testing, but --
22 MEMBER MARCH-LEUBA: Okay, so that's what 23 I was going to ask you. It's limited by tech specs, 24 the amount of time that you can be in this dangerous 25 configuration?
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
194 1 MR. CARTE: Yes.
2 MEMBER MARCH-LEUBA: Okay, and you've 3 looked at it and you're happy with, I mean --
4 MR. CARTE: We're not done with tech 5 specs, but we're heading in the right direction.
6 MEMBER MARCH-LEUBA: Okay, thanks.
7 MEMBER BROWN: Norbert?
8 MR. CARTE: Yes?
9 MEMBER BROWN: Back at the beginning of 10 your spiel, you mentioned that, you stated that within 11 the mode or some circumstances, some functions aren't 12 necessary and they are automatically disabled.
13 MR. CARTE: Correct.
14 MEMBER BROWN: Is there an indication that 15 they've been disabled?
16 MR. CARTE: Right, so this is where --
17 MEMBER BROWN: To the operators?
18 MR. CARTE: Well, we haven't finished 19 looking at PICS and the PICS doesn't have the specific 20 information. It is all communicated to the PICS, so.
21 MEMBER BROWN: That's my thought. That's 22 what I was asking about. Is it available to the 23 operators when they -- in the PICS, fundamentally in 24 the control room or whatever is it?
25 MR. CARTE: Right, so since we're not done NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
195 1 with PICS, I hesitate, but the information is --
2 MEMBER BROWN: That's fine. That's okay.
3 I just -- you're looking at it. You can let us know 4 when we get to that point.
5 MR. CARTE: It's output to PICS --
6 MEMBER BROWN: Yeah.
7 MR. CARTE: -- at this point.
8 MEMBER BROWN: Okay --
9 (Simultaneous speaking.)
10 MR. CARTE: And the bypass is, yes, the 11 bypass is indicated in the block diagrams, the figures 12 that are in the proprietary section, and those figures 13 in the proprietary material are just the FSAR figures 14 in case we wanted to talk about them, but all of the 15 mode enable aspects are in those logic diagrams.
16 MEMBER BROWN: Okay, all right, that's it.
17 Thank you.
18 MR. CARTE: Next slide? So, if we talk 19 about design criteria, basically one design criteria 20 is that transients won't cause -- not fuel. I can't 21 say fuel. It's not a reactor -- solution, target 22 solution design limits to be exceeded, right?
23 So, we did look at those events and we 24 believe that is the case. There was some discussion 25 about what is a transient? The other requirement is NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
196 1 that it initiate functions in the case of an accident.
2 Well, all of the functions that the system 3 does are traced to different scenarios in chapter 13, 4 so it meets that criteria. We didn't find any 5 inconsistencies between the FSAR chapters and the 6 functions described in chapter seven.
7 So, the other, I mean, the failsafe 8 criteria which you mentioned is listed in the FSAR for 9 chapter seven. So, if you lose power -- so basically 10 it goes into the safe state by removing power to the 11 component, and therefore if you lose power to the 12 TRPS, you're going to lose -- it's going to go into 13 the safe state anyway.
14 So, failsafe criteria is pretty easy to 15 achieve for loss of power. That's a program feature 16 into the HIPS equipment as well. Certain modules fail 17 safe. We discussed control of access and we discussed 18 independence from PICS through the one-way 19 communication.
20 There's another criteria which I didn't 21 mention here, the separation of protection and 22 control. There are no, in a sense, shared protection 23 and control equipment.
24 So, the protection and control criteria is 25 targeted at a very specific problem, well, in general.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
197 1 If you really -- let me see how much -- the basic 2 philosophy is generally that a facility can withstand 3 two bad things, and this is not regulatory speak, 4 right?
5 The first bad thing, we call an initiating 6 event. It can be an operator action or it can be 7 failure, and the second bad thing is sometimes called 8 a single failure within the protection system.
9 Now, in the unique case where the 10 protection system and the control system share 11 components, how do you deal with the two failure 12 criteria? And that's what the separation of 13 protection and control criteria is for.
14 There are no shared components, so it's 15 kind of an irrelevant criteria for this design because 16 they could have just said we don't share components, 17 but they had criteria for is they do, but they don't, 18 so it's kind of an irrelevant criteria at this point.
19 Next slide, please?
20 So, we've already discussed the basic 21 design bases functions. If you go to the FSAR, it's 22 actually discussed at various levels. You have this 23 level of function discussed and then the next level is 24 sets of components actuated, like which particular 25 valves.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
198 1 The valve numbers are not provided. If 2 you look at the diagrams in chapter four, you can't 3 trace the specific valves described in chapter seven 4 to the valves on the diagrams in figure four since 5 they're not labeled, but that's something we would 6 also do as part of an audit.
7 We would do a thread audit on one 8 particular event and trace that all the way from the 9 safety analysis assumed values to the RPS functions, 10 the equipment specs, components actuated and diagrams, 11 just to see that we had a feeling that their document 12 shows that everything is addressed.
13 We typically do that, two or three thread 14 audits, or for a power plant, we do two or three. I'm 15 not quite sure how many we'll do here, and the thing 16 that's actually most important is the analytic limits.
17 And we did have our fellow other chapter 18 reviewers look at the analytic limits in chapter seven 19 and they concurred that those are the right values 20 since we couldn't cross-check the analytic limits 21 through chapter 13 or because chapter 13 didn't 22 actually have the specific analytic limits in it.
23 It's in the underlying calcs. Next slide, please?
24 So, I guess I went into this a little bit.
25 So, in terms of the design bases, what's really NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
199 1 covered well in the TRPS, I mean in the FSAR is the 2 design bases. So, it's telling you what the variables 3 monitored are.
4 It links to specific events covered in 5 chapter 13. Chapter 13 then references back to 6 chapter four. It identifies the specific equipment 7 actuated or the functions like TRPS isolation, TSV 8 isolation, TSV dump, but not the specific valves, 9 which we might check later.
10 And the analytic limits that we see in 11 Table 741 were mapped over to the tech specs. We 12 still need to -- we have done some thread audits on 13 set point calculations to look at the limiting safety 14 system setting that is actually in the LCO, some 15 further discussions on that.
16 Operation site criteria, I can't remember 17 what I was going to say on that last one. Next slide?
18 MEMBER BROWN: Good choice.
19 MR. CARTE: So basically these are the 20 same words that is in the safety evaluation, we have 21 concluded that the design meets the design criteria, 22 supports the functions in the other chapters.
23 We still have yet some confirmatory audits 24 to do in terms of set point calculations in the tech 25 specs, in terms of equipment meeting the values in the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
200 1 set point calculations, in terms of development 2 processes for TRPS and HIPS, and traceability of 3 values through the design documentation is what we're 4 going to do.
5 Sorry, that was a lot coming at you very 6 quickly. Any questions?
7 MEMBER REMPE: So this is Joy, and I guess 8 I'm going to follow up on my earlier question. Could 9 you talk about where you are with this audit and 10 report?
11 Is this the right place? I know there's 12 a slide, like, 42, but I think that's a backup slide, 13 right?
14 MR. CARTE: Well, so ideally, from my 15 point of view as a regulator, I want to put the audit 16 off as long as possible. Because that means I'm 17 looking at things that are as complete as possible, 18 the more draft it is the less of a litmus test I get 19 from looking at a document.
20 And so I think the ball -- we're really 21 just in the --
22 MR. WATERS: Norbert, this is Mike Waters, 23 let me clarify.
24 So we have an open audit plan, the audit's 25 ongoing, we are primarily focused on the sub points NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
201 1 and, you know, we're close to core loading, as I 2 mentioned in the beginning. But for reviewers on the 3 panel limits and response times that's, you know, 4 described and validated by chapter, so it's part of 5 the open tech spec review which, you know, we're not 6 really prepared to talk about in any detail right now.
7 MEMBER REMPE: Well okay, so, again, I'm 8 not going to say anything proprietary, it's very 9 general -- but if it needs to be in a closed session 10 or something later, that's fine. But with the 11 information we were provided last month, I know they 12 cited chapters as the reference for some of the 13 assumed times, and I mentioned, hey, you know, that's 14 great but it's not in those other chapters, and the 15 Applicant acknowledged, yeah, it's not. And then I 16 turned to the staff and said, how did you guys 17 conclude that the timing for the response of the 18 sensors and subsequent actions was adequate without 19 having those times?
20 And I was referred to the audit and the 21 report that's not yet available as where staff gained 22 the confidence to believe that things were adequate.
23 And will that be documented in the audit report?
24 MR. WATERS: I believe so. And what 25 you're talking about is a, you know, it's both, an I&C NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
202 1 issue and assistant reviewer's issue -- we're working 2 together on that issue.
3 And you're right that, as the reference in 4 SE, some of the validation is referred to the 5 underlying documents and the basis for that, that is 6 confidence that the analytical limit and response 7 times are correct.
8 And I can assure you, you know, internally 9 the ones we looked at had been validated for some of 10 the more risk-significant event sequences, within the 11 underlying documents, when you put it all together.
12 MEMBER REMPE: So this sounds great but 13 I'm from Missouri, I'd like to see it. When will it 14 be available for ACRS?
15 MR. BORROMEO: So this is Josh --
16 (Simultaneous speaking.)
17 MR. WATERS: I -- okay, Josh. I was going 18 to refer to Joshua.
19 MR. BORROMEO: Yeah. So this is Borromeo, 20 Chief of the NPUF Licensing Branch. So maybe I can 21 put, maybe a little bit of a -- coming at a different 22 angle so, you know, we tried to find the appropriate 23 place to kind of draw the line for, you know, when we 24 complete these audits -- and as we mentioned a couple 25 times, like, we're still doing the tech spec review.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
203 1 We're wrapping up the tech spec review 2 right now, we're slated to come to you in the early 3 September time frame to discuss that. But we still 4 have some ongoing audits related to I&C so, you know, 5 I'm hopeful, you know, in the next -- shortly after 6 the SE is completed -- that we will be able to the 7 issue the audit report to you as well. And I'm 8 thinking that we will do it in a way that we completed 9 the NuScale audit reports, that they just came just 10 after the SE was completed.
11 MEMBER REMPE: Can we see a draft before?
12 I mean, again, I mean --
13 (Simultaneous speaking.)
14 MR. BORROMEO: Yes. Yeah, so -- yes, we 15 can --
16 MEMBER REMPE: Something that we know and 17 have confidence in. Because I get it, that you have 18 to do, like, a bunch of internal reviews. But I just 19 would like to see a draft, even, to give -- you know, 20 you're documenting what gave you this confidence.
21 MR. BORROMEO: Understood. We can 22 certainly provide the draft prior to the ACRS 23 meetings.
24 MEMBER REMPE: So sometime in August we'll 25 see this, is that a good assumption of what you're NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
204 1 telling me?
2 MR. BORROMEO: We can provide something to 3 you in August, how about that? Can I promise 4 something? Is something better than nothing?
5 MEMBER REMPE: You bet, and August sounds 6 good. Thank you.
7 MR. BORROMEO: Okay.
8 CHAIRMAN BALLINGER: This is Ron, am I 9 reading between the lines that chapter seven is not 10 complete, the review?
11 (Simultaneous speaking.)
12 PARTICIPANT: Is a draft a problem in 13 terms of --
14 MR. BORROMEO: Well -- someone's talking.
15 Maybe --
16 MEMBER BROWN: Well, obviously it's not 17 complete, we've only covered 7.4 and 7.5 in this 18 meeting. There's still 7.1 through three and 7.6, 19 seven, eight, and nine.
20 CHAIRMAN BALLINGER: Okay, I got it. I 21 got it.
22 MR. BORROMEO: Right. So some of these 23 sections, they do have overlap, all right? So, you 24 know, we present today on the areas where we have, you 25 know, come, you know, made a determination on but for NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
205 1 the overall I&C system, that review is still ongoing.
2 We felt that this approach would help us, 3 you know, continue to move the review along 4 efficiently.
5 MEMBER BROWN: And this is a much easier 6 way to do it, so this only covers 7.4 and 7.5.
7 MR. BORROMEO: Right, and --
8 MR. CARTE: Well a little bit more than 9 that because part of the problem is, the neutron flux 10 detection system is actually, kind of, three 11 complicated -- it's not really a system, it's three 12 complicated input channels, right? Two detectors in 13 each channel, three signals in each channel -- source, 14 power, and wide, right? But it's not really a system, 15 it's three independent inputs.
16 So we're treating neutron flux detection 17 system as sort of an input to the TRPS in our safety 18 evaluation, and the radiation monitoring system is 19 also not a system, so to speak. There are some inputs 20 that have various functions, like continuous air 21 monitoring systems, or the stack release monitoring 22 system, or the inputs, the ESFAS or tritium.
23 So there are different inputs and they're 24 lumped and described together under the one name of 25 radiation monitoring, but the inputs to TRPS -- those NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
206 1 that are inputs to TRPS and ESFAS were covered today.
2 MEMBER BROWN: Norbert, you're making this 3 complicated. There's a Section 7.8 on the nuclear 4 flux detection system and there's another section on 5 the RMS. So I --
6 MR. CARTE: The neutron flux detection 7 system was covered today.
8 MR. WATERS: Let me -- this is Mike, let 9 me try to address the bigger question.
10 For the safety related I&C, our design 11 review was essentially complete with the exception of 12 the few things I noted up front. One being, you know, 13 the life cycle development process of programmable 14 logic, that's part of the statement of findings, so 15 that's still open.
16 As well as the technical specification 17 issues, as Norbert talked about, and some of the 18 underlying audit issues, you know, related to sub 19 point calculations, response times, and analytical 20 limits, that's still ongoing.
21 And in a confirmatory sense, you know, the 22 explanation and the FSAR on that appears to be 23 generally sound, but part of our confirmatory view is 24 looking at those things as part of our audit process 25 to confirm it. And of course we have not completed a NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
207 1 review of PICS.
2 So that's the current stated evaluation, 3 you know, the safety system review is very -- in the 4 grand scheme of things -- very close to complete with 5 the exception of the few things that we still review 6 and are looking at. And I'll --
7 (Simultaneous speaking.)
8 MEMBER BROWN: Well, somewhere between 9 five and seven, you know, seven-eight are -- like, 10 you've completed them. I mean, you've, I assume --
11 (Simultaneous speaking.)
12 MR. WATERS: Yes, RMS and NFDS is complete 13 from a design standpoint.
14 MEMBER BROWN: Yeah. So the outstanding 15 -- I mean, 7.1 for instance covers a lot of stuff 16 relative to operators, displays, and stuff like that, 17 but I thought you were going to be covering that in 18 the PICS discussion since --
19 (Simultaneous speaking.)
20 MR. WATERS: Yes --
21 MEMBER BROWN: In the main control rooms 22 and stuff.
23 MR. WATERS: Anything related to PICS and, 24 you know, the control room displays -- we're just 25 calling it PICS as one -- will probably be one section NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
208 1 we'll talk about that together.
2 MR. CARTE: So Human Factors obviously, 3 has the arrangement and display of information and how 4 that relates to the operator's task. We're looking at 5 it more from a functional, how the equipment is 6 arranged, not how it's presented to the operator.
7 MR. WATERS: Right. I didn't want to 8 imply we're doing that type of review, I think 9 Charlie's talking about what SRP says for chapter 10 seven.
11 MR. CARTE: Right, but Human Factors is 12 doing the human part.
13 MEMBER BROWN: That's tomorrow.
14 MR. CARTE: Yeah.
15 MEMBER BROWN: That's tomorrow. 7.9 is 16 tomorrow, tomorrow at 11:00 o'clock, if we're on time, 17 as part of the presentations.
18 MR. WATERS: Yep.
19 MEMBER BROWN: And, you know, I had a 20 bunch of questions on displays and stuff like that, 21 I'll pass those on but I wasn't going to mouse-milk 22 them today, other than let you know what they are.
23 But -- well, I was going to do that at the 24 end. I wanted to get through this other stuff first 25 and make sure we closed out seven-four and seven-five, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
209 1 and seven -- whatever, seven-eight, and whatever the 2 RMS one is, seven-seven or something.
3 MR. WATERS: Well we can transition over 4 to Dinesh, you know, ask Dinesh to expedite, get us 5 back on schedule here. And then the ACRS can make a 6 decision if we need any specific proprietary 7 discussions, if that's okay with the committee.
8 MEMBER BROWN: The logic diagrams, my 9 personal opinion, we don't need to go through them, 10 okay? You've got a whole bunch of those and we ought 11 to go through the other part, unless Ron wants to 12 countermand me and sit through somebody explaining all 13 those little one-line diagrams to you.
14 CHAIRMAN BALLINGER: You're not going to 15 get pushback from me on that, I've look at both, the 16 staff and the SHINE presentations, and the diagrams 17 are, they're basically the same sets of diagrams.
18 MEMBER BROWN: Yes.
19 CHAIRMAN BALLINGER: But let's try to 20 continue, I'm sorry I complicated things.
21 MEMBER BROWN: Yes.
22 MR. CARTE: One last point before we move 23 on, I think what you're going to get from Human 24 Factors tomorrow is a discussion of the -- it's a 25 process oriented review, not -- but I think that's NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
210 1 what you're going to get, a process, not the actual 2 display review.
3 But we can move on to ESFAS.
4 MEMBER BROWN: Yep.
5 MR. CARTE: Next slide, please.
6 MEMBER BROWN: I don't even have a section 7 7.9 in my ESFAS document right now, I don't even have 8 a copy of that so I've got to go find it somewhere.
9 I don't know who's got that.
10 MR. TANEJA: All right. We're ready?
11 MEMBER BROWN: Yep.
12 MR. TANEJA: So this is Dinesh again. So 13 the ESFAS is in section 7.5 of the FSAR and I am 14 combining that with the RMS, that is section 7.7 of 15 the FSAR. So primarily all the safety related process 16 radiation monitors which are part of the RMS provide 17 analog signals to ESFAS and the TRPS, to generate the 18 actuation signals.
19 So what we are getting from these 20 radiation monitoring systems is a analog signal that, 21 you know, is coming into the safety function modules 22 and then the logic in the safety function module is 23 determining the trip state based on the set point.
24 And also it's processing that signal and 25 sending it over to the monitoring and indication bus, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
211 1 which gets sent over to the, you know -- which is all 2 getting sent over to PICS.
3 Now, like Norbert said, we are still, you 4 know, reviewing the PICS design so all the information 5 and what information is made available to the 6 operators is going to be part of that discussion, but 7 the information is being sent over there.
8 So primary function, the ESFAS monitors 9 the process variables for confinement of fission 10 products and tritium, and for criticality safety. And 11 it also provides all the process variable values and 12 the system status indication to PICS for viewing, 13 recording, and trending. Next slide, please.
14 So this is the ESFAS architecture which is 15 very similar to the TRPS architecture, the only 16 differences is in the TRPS we have basically nine 17 separate systems, each for one of the IU cells.
18 Here we have one ESFAS system for the 19 entire facility, basically we have three cabinets, 20 each cabinet just consisting of a division, A, B, and 21 C of the ESFAS. And other than that they are very 22 identical, the only difference being that in ESFAS we 23 have some, you know, that are based on one-out-of-two 24 logic. So that input, you know -- we don't have that 25 input going to the C channel, it only goes into NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
212 1 channel A and B.
2 And then we have some variables where we 3 have only channel A inputs -- well actually the 4 channel A actuation of the device, because there are 5 credit being taken for some check valves to provide 6 the redundancy and isolation function. And we have 7 one active valve and one check valve, so we have 8 channel A providing the actuation and then the passive 9 valve doesn't have any input coming into it. Next 10 slide, please.
11 So the ESFAS and the RMS design, you know, 12 I think, you know, the SHINE criterias that apply to 13 it are the, you know, the general design criterias one 14 through six, and 13 through 19, and 37 to 39, they 15 apply to the ESFAS. And for the RMS, the general 16 criteria is one, two, four, and then 13 and 38 apply 17 to the radiation monitoring system.
18 So the key features of the feature is, 19 like, I guess the criteria five talks about sharing of 20 the system between control and, you know, and the 21 protection system. Same thing is true here in ESFAS, 22 they do not share any component between the radiation 23 units and the control system. So that's all -- and 24 that's how they meet SHINE criteria five.
25 And then the criteria 13 talks about the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
213 1 I&C, so we have seven, five, one that provides all the 2 signals that are being monitored by the ESFAS. And, 3 you know, and we reviewed that and we basically came 4 to conclusion that the ESFAS has operable protection 5 capability in all operating modes, anticipated 6 transients, and postulated accidents. So therefore it 7 meets the design criteria 13. Next slide, please.
8 Design criteria 14 talks about protective 9 system functions, so we looked at all the protective 10 system functions and looked at the basis (audio 11 interference) or, you know, essentially the accidents 12 that are credited in chapter 13, and these are the 13 function that are required to either, you know, 14 maintain the facility confinement strategy and provide 15 process shutdown functions. So we reviewed that and 16 we came to the finding that the, you know, design 17 meets SHINE criteria 14.
18 We talked about the, you know, protection 19 system failure mode. So the HIPS platform, you know, 20 is designed to fail safe, and we looked at all the, 21 you know, components in the ESFAS design and they are 22 all also designed to fail in a safe state. The 23 passive components, such as check valves as well as 24 the, you know, active components, you know, they fail 25 safe on loss of power or the, you know, loss of the NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
214 1 ESFAS component, or any adverse environmental 2 conditions will result in a fail safe state. And we 3 also, you know, audited the ESFAS and TRPS single 4 failure analysis to come to the same conclusion.
5 Separation of protection and control 6 system, that's SHINE criteria 18. Essentially the 7 same thing, you know, there is, you know, no sharing 8 of the components and there is separation maintained 9 between PICS and the protection system by the means 10 the interfaces are implemented.
11 That is, we have one-way data going out to 12 PICS for display and, you know, out for the operators, 13 and also doing any kind of trending and, you know, and 14 data logging. And any inputs coming in from PICS are 15 coming through hardwired inputs through the, you know, 16 through the isolated contacts.
17 So that separation is maintained between 18 protection and control system, so any failure that may 19 happen in the control system would not have any 20 adverse impact to the ESFAS performing its safety 21 function. So from there we came to the conclusion 22 that the design meets SHINE design criteria 18. Next 23 slide, please.
24 Protection against anticipated transients.
25 So that is the SHINE design criteria 19, and here, you NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
215 1 know, we have the ESFAS, you know, implemented on the 2 HIPS platform which is a deterministic functionality.
3 And primarily because of that, you know, it's --
4 everything is implemented on that so there is a -- and 5 then, you know, the way it's implemented and using the 6 three channels, it has a high probability of achieving 7 all of safety function under all postulated 8 conditions. So that's how we came to the conclusion 9 of compliance to design criteria 19.
10 Criteria 37 is criticality control in a 11 radio isotope production facility. So most of the 12 criticality controls are achieved by the -- in a 13 passive design nature of the plant, and some 14 administrative controls. But there are two functions 15 that are relied upon, you know, for active engineer 16 control to provide the double contingency principle, 17 and these are the two safety functions, vacuum 18 transfer actuation and the DSPS distillation tank 19 isolation functions.
20 So they are, you know, providing the 21 engineered, active engineered criticality safety to 22 satisfy the design criteria 37.
23 Monitoring of radioactive releases, that's 24 criteria 38. So there is actually a table in section 25 7.7 that identifies all the safety related, you know, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
216 1 process, radiation monitors -- we looked at that. We 2 also looked at non-safety related area radiation 3 monitors, and the other affluent monitors to 4 essentially assure that there was adequate coverage of 5 all the monitoring of the -- and as well as, I think 6 we coordinated the review with the other chapters for 7 looking at all the radio monitors to come to a 8 conclusion that it meets criteria 38. So next slide, 9 please.
10 Hydrogen mitigation, that's criteria 39.
11 So ESFAS is designed to initiate hydrogen purge to 12 control any buildup of hydrogen that releases into the 13 primary system boundary.
14 And we reviewed that and essentially 15 initiates the nitrogen purge system under certain 16 circumstances, and, you know, and those logics, we 17 looked at the logic diagrams, and we looked at the 18 interfaces between the ESFAS and the TRPS to initiate 19 the hydrogen purge for a given condition, and came to 20 a conclusion that it complies with the SHINE design 21 criteria 39.
22 And then there were some specific, you 23 know, design specific criterias and the single failure 24 criteria essentially that I wanted to highlight here, 25 is that in the ESFAS design we have instances where NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
217 1 the actuator components are only in division A and 2 then we rely on these passive check valves for the 3 redundancy purposes. So that's how it meets the 4 single failure criteria and, you know, so no single 5 failure is going to result in loss of protective 6 action. Next slide, please.
7 So, you know, I think, you know, this is 8 basically the conclusion, summary from the safety 9 evaluation that really came to the conclusion that the 10 ESFAS and the radiation monitoring system --
11 specifically the safety related process radiation 12 monitors -- meet the specified design criterias. And 13 the ESFAS and the RMS are capable of performing their 14 allocated design functions under all postulated 15 conditions.
16 So that is my presentation on ESFAS and 17 RMS. Are there any questions?
18 (No audible response.)
19 CHAIRMAN BALLINGER: Okay, I think, if 20 there aren't any questions, that concludes the staff 21 presentation, correct?
22 MR. TANEJA: Correct.
23 CHAIRMAN BALLINGER: So what we need to do 24 now is to ask for public comments, and then have the 25 discussion related to the necessity of having closed NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
218 1 session.
2 So if there are members of the public that 3 would like to make a comment, please unmute yourself 4 and state your name and make your comment please.
5 (No audible response.)
6 CHAIRMAN BALLINGER: It's hard to tell.
7 Okay, it doesn't sound -- it doesn't appear that we 8 have any members of the public that would like to make 9 a comment, so now we need to have the discussion about 10 whether or not we need a closed session.
11 Now, Charlie, has your opinion remained 12 the same?
13 (No audible response.)
14 CHAIRMAN BALLINGER: Hello?
15 (No audible response.)
16 CHAIRMAN BALLINGER: Well, while we're 17 waiting for Charlie, other members and/or the --
18 MEMBER BROWN: My mic was off, I'm sorry.
19 My mic was off and it was hidden by one of the other 20 charts I had up.
21 No, I haven't changed my mind at all. As 22 far as I'm concerned those will not add, the value was 23 added by the presentations they made. That's my 24 opinion.
25 CHAIRMAN BALLINGER: Thank you.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
219 1 Now I should also ask the staff, as well 2 as SHINE, whether they feel that there is additional 3 information that needs to be conveyed by having a 4 closed session?
5 MR. BALAZIK: This is Mike Balazik with 6 the NRC staff, we just had those in case we went into 7 proprietary information to support our discussion, so 8 my opinion, we don't need one for the NRC staff.
9 CHAIRMAN BALLINGER: Tracy? Who am I 10 asking in the SHINE side?
11 MR. BARTELME: This is Jeff Bartelme from 12 SHINE. No, agree, don't have to go into closed 13 session but before we do wrap, there was a -- from the 14 staff presentation, Member Brown's question on ESFAS 15 criterion 18 and why there's not a comparable TRPS 16 criterion, and we do want to address that before we 17 wrap today.
18 CHAIRMAN BALLINGER: Okay, well why don't 19 you give it a shot.
20 MS. RADEL: This is Tracy, so the ESFAS 21 criterion in question, criterion 18, and that is a 22 system specific design criteria versus a SHINE general 23 design criteria, is only applied to ESFAS versus both, 24 ESFAS and TRPS. And that is because it comes out of 25 the draft chapter seven of the interim staff guidance, NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
220 1 which -- it comes specifically out of the radiation 2 monitoring section, and it is applied for systems 3 where you're monitoring for radiological release into 4 the facility, out of the confinements, and out of the 5 facility. And so those monitoring systems are within 6 the ESFAS system, not within the TRPS.
7 There are radiation monitors on the outlet 8 of the IU cells but those are redundant to the RVZ1 9 and RVZ2 ones within ESFAS, as far as their flow 10 paths. So we applied it only to the ESFAS system and 11 not to both.
12 CHAIRMAN BALLINGER: Does that answer your 13 question, Charlie?
14 MEMBER BROWN: I don't know.
15 (Laughter.)
16 MEMBER BROWN: I was trying to look for 17 something a little bit more crisp. You said it came 18 out of what document? You cited a document that I 19 wasn't aware of.
20 MS. RADEL: It came out of the draft 21 chapter seven interim staff guidance for NUREG 1537, 22 which is where all the system specific I&C design 23 criteria came from. And that particular design 24 criterion came from the radiation monitoring section 25 of that draft chapter seven.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
221 1 MEMBER BROWN: So the words, the 2 protection system is separated from control systems to 3 the extent that any failure of a single control or 4 channel, or failure or removal from the service of any 5 protection system or component that is common to the 6 controller protection systems leaves intact a system 7 satisfying all reliability, redundancy, and 8 independence requirements of the protection system.
9 Interconnections of the protection system is limited 10 to ensure that safety is not significantly impaired.
11 And I'm trying to figure -- you're saying 12 there's no application in (audio interference) your 13 all's response and it says, there are no sensor 14 outputs that have ESFAS and a non-safety related 15 control function, therefore we're not doing anything 16 (audio interference) that.
17 Is that correct, even though you listed 18 it?
19 MS. RADEL: There are separate single 20 failure criterion that are applied to TRPS -- sorry, 21 I'm looking. So there's still TRPS --
22 (Simultaneous speaking.)
23 MEMBER BROWN: I don't see anything to 24 deal with radiation monitoring in there, that's all 25 I'm saying.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
222 1 MR. BARTELME: I want to be sure -- this 2 is Jeff Bartelme, I want to be sure we're not 3 confusing, you know, how ESFAS meets design criterion 4 18, and how ESFAS meets that specific ESFAS criterion 5 18. We've got both, SHINE general design criterion 6 and system specific design criterion listed in both, 7 seven-four and seven-five.
8 What we're describing here is how we meet 9 ESFAS criterion 18 and why there's not a corresponding 10 system specific criterion for TRPS.
11 MEMBER BROWN: Yeah. That's what I'm 12 looking at. I'm sorry, I read from the wrong one.
13 But no single failure with failures result 14 of design basis event should prevent operators from 15 being presented information necessary to determine the 16 safety status of the facility following the event.
17 So you're saying, because ESFAS is 18 facility covered and TRPS is an individual system 19 coverage, that that's why that applies to ESFAS. Did 20 I phrase that properly?
21 MS. RADEL: Yes, that is correct.
22 MEMBER BROWN: Okay, I got it now. You 23 had far more words.
24 Okay, so the answer is varied -- it's not 25 varied, it's necessary to determine the safety status NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
223 1 of the facility, following the design basis event.
2 More specific detailed, I got it.
3 Okay? We're good, you're good, you don't 4 have to do anything else. Thank you for making sure 5 I knew what to look at.
6 CHAIRMAN BALLINGER: Okay. So now let's 7 ask questions from the members or consultants, are 8 there questions that you may have that would require 9 us to have a closed session either, from members or 10 consultants?
11 MARCH-LEUBA: This is Jose, I don't have 12 any more questions. My concerns were addressed.
13 CHAIRMAN BALLINGER: Thanks.
14 MEMBER SUNSERI: This is Matt, I don't 15 need a closed session.
16 CHAIRMAN BALLINGER: Okay. Well, I'm 17 assuming --
18 MEMBER REMPE: So this --
19 CHAIRMAN BALLINGER: Whoop. Okay.
20 MEMBER REMPE: This is Joy, I don't need 21 a closed session but I am looking forward to receiving 22 what Josh said he'd provide in August.
23 CHAIRMAN BALLINGER: Yes.
24 MEMBER REMPE: Something is definitely 25 better than nothing.
NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
224 1 (Laughter) 2 CHAIRMAN BALLINGER: I think there's a 3 song here somewhere.
4 Anyway, okay, absent any additional 5 requirements for a closed session, then we are in --
6 thank you very --
7 MEMBER BROWN: No, don't stop. I think 8 between us we ought to make sure of one other thing in 9 your schedule for tomorrow, just amongst us. I mean, 10 the staff can stay there because I'm not quite sure --
11 you've got a one hour session tomorrow, between 11:00 12 and 12:00, on Human Factors, chapter 12, section 7.9.
13 I went back and looked at chapter 12, 14 couldn't find it -- at least on the version of the 15 document I've got on my laptop, of the FSAR, and I 16 couldn't find a section 7.9. And I think Vicki is 17 supposedly working Human Factors, so maybe she's got 18 something that I don't know about it.
19 I just want to know that we have something 20 to talk about, or we have something to review, because 21 I see they do have slides on it. It's 7.4.9 or 22 something is what they're referring to on their 23 slides.
24 MR. CARTE: Michael, can you clarify --
25 MR. BARTELME: I think the SE input NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
225 1 provided to you was labeled chapter seven-nine -- it's 2 not a part of chapters 12, it's actually a separate SE 3 section called 7.9. Do you have an SE section seven-4 nine?
5 MEMBER BROWN: I didn't look at the SE, I 6 looked at the FSAR.
7 MR. BALAZIK: This is Mike Balazik, the 8 SHINE project manager. Yeah, it's added to the end of 9 chapter seven SE, that's where we decided that Human 10 Factors would best fit. We were debating whether to 11 put it in chapter 12 or chapter seven, but we 12 concluded that it would best fit in chapter seven 13 because in the NUREG 1537 it does talk about certain 14 aspects of Human Factors, so that's where we plan on 15 putting it.
16 MEMBER BROWN: Okay, I found it, I went 17 off and -- I just looked up the SER, it's there.
18 Vicki, are you there?
19 MEMBER BIER: Yes, I'm on.
20 MEMBER BROWN: Were you aware of this?
21 MEMBER BIER: Yeah, I had it. Sorry.
22 MEMBER BROWN: Okay. All right. I 23 apologize --
24 MEMBER BIER: No problem.
25 MEMBER BROWN: I was just trying to make NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
226 1 sure, my ignorance --
2 (Simultaneous speaking.)
3 MEMBER BIER: Yeah. I appreciate it.
4 MEMBER BROWN: All right. I'm sorry for 5 the confusion, troops.
6 MEMBER BIER: No, I'm glad to get it 7 straightened out.
8 CHAIRMAN BALLINGER: Okay, so I think 9 we've concluded we do not need a closed session, and 10 we're having discussions related to other things. Are 11 there any other discussions that we need to have 12 before tomorrow?
13 (No audible response.)
14 CHAIRMAN BALLINGER: Okay. Then I would 15 -- then we thank you very much for the presentations, 16 I'm sure we're all thankful for the presentations.
17 We are now adjourned until 9:30 tomorrow 18 morning. Thank you again, folks.
19 (Whereupon, the above-entitled matter went 20 off the record at 4:52 p.m.)
21 22 23 24 25 NEAL R. GROSS COURT REPORTERS AND TRANSCRIBERS 1716 14th STREET, N.W., SUITE 200 (202) 234-4433 WASHINGTON, D.C. 20009-4309 www.nealrgross.com
Design Criteria TRACY RADEL, VICE PRESIDENT OF ENGINEERING
© SHINE
© SHINE Technologies, Technologies, LLC LLC 1
Outline Development of SHINE Safety Criteria SHINE Safety Criteria Development of SHINE Design Criteria SHINE Design Criteria o Generally-Applicable Design Criteria o Subcritical Assembly Design Criteria o Instrumentation, Control, and Protection System Design Criteria o Primary System Boundary Design Criteria o Electric Power Systems Design Criteria o Confinement and Control of Radioactivity Design Criteria
© SHINE Technologies, LLC 2
Development of SHINE Safety Criteria Safety-related structures, systems, and components (SSCs): Those physical SSCs whose intended functions are to prevent accidents that could cause undue risk to health and safety of workers and the public; and to control or mitigate the consequences of such accidents.
Acceptable risk can be achieved by an event being highly unlikely ( 10-5 per event, per year) or having consequences less severe than the SHINE safety criteria.
SHINE safety criteria were developed using:
o NUREG-1537 and Interim Staff Guidance (ISG) augmenting NUREG-1537 o 10 CFR 70.61 o 10 CFR 50.2 o NRC-proposed accident dose criterion (as part of proposed rulemaking related to non-power production and utilization facility license renewal)
© SHINE Technologies, LLC 3
SHINE Safety Criteria An acute worker dose of 5 rem or greater total effective dose equivalent (TEDE)
An acute dose of 1 rem or greater TEDE to any individual located outside the owner controlled area An intake of 30 milligrams or greater of uranium in a soluble form by any individual located outside the owner controlled area An acute chemical exposure to an individual from licensed material or hazardous chemicals produced from licensed material that could lead to irreversible or other serious, long-lasting health effects to a worker or could cause mild transient health effects to any individual located outside the owner controlled area Criticality where fissionable material is used, handled, or stored (with the exception of the target solution vessel)
Loss of capability to reach safe shutdown conditions
© SHINE Technologies, LLC 4
Development of SHINE Design Criteria Developed based on 10 CFR 50, Appendix A and 10 CFR 70.64(a) design criteria The design criteria are selected to cover:
o The complete range of irradiation facility and radioisotope production facility operating conditions o The response of SSCs to anticipated transients and potential accidents o Design features for safety-related SSCs including redundancy, environmental qualification, and seismic qualification o Inspection, testing, and maintenance of safety-related SSCs o Design features to prevent or mitigate the consequences of fires, explosions, and other manmade or natural conditions o Quality standards o Analyses and design for meteorological, hydrological, and seismic effects o The bases for technical specifications necessary to ensure the availability and operability of required SSCs
© SHINE Technologies, LLC 5
Generally-Applicable Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 1 1 Quality standards and records 10 CFR 70.64(a)(1)
Natural phenomena hazards 10 CFR 50 Appendix A, Criterion 2 The facility structure supports and protects Structures, systems, and components important to safety shall be designed to safety-related structures, systems, and withstand the effects of natural phenomena such as earthquakes, tornadoes, components (SSCs) and is designed to hurricanes, floods, tsunami, and seiches without loss of capability to perform withstand the effects of natural phenomena such their safety functions. The design bases for these structures, systems, and as earthquakes, tornadoes, hurricanes, floods, components shall reflect: (1) Appropriate consideration of the most severe of 2 tsunami, and seiches as necessary to prevent the natural phenomena that have been historically reported for the site and the loss of capability of safety-related SSCs to surrounding area, with sufficient margin for the limited accuracy, quantity, and perform their safety functions. period of time in which the historical data have been accumulated, (2)
Safety-related SSCs are designed to withstand appropriate combinations of the effects of normal and accident conditions with the effects of earthquakes without loss of the effects of the natural phenomena and (3) the importance of the safety capability to perform their safety functions. functions to be performed.
10 CFR 70.64(a)(2) 10 CFR 50 Appendix A, Criterion 3 3 Fire protection 10 CFR 70.64(a)(3)
© SHINE Technologies, LLC 6
Generally-Applicable Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 4 Structures, systems, and components important to safety shall be designed to Environmental and dynamic effects accommodate the effects of and to be compatible with the environmental conditions Safety-related structures, systems, and associated with normal operation, maintenance, testing, and postulated accidents, components (SSCs) are designed to including loss-of-coolant accidents. These structures, systems, and components shall perform their functions with the be appropriately protected against dynamic effects, including the effects of missiles, environmental conditions associated with 4 pipe whipping, and discharging fluids, that may result from equipment failures and from normal operation, maintenance, testing, events and conditions outside the nuclear power unit. However, dynamic effects and postulated accidents. These SSCs associated with postulated pipe ruptures in nuclear power units may be excluded from are appropriately protected against the design basis when analyses reviewed and approved by the Commission dynamic effects and from external events demonstrate that the probability of fluid system piping rupture is extremely low under and conditions outside the facility.
conditions consistent with the design basis for the piping.
Sharing of structure, systems, and components 10 CFR 50 Appendix A, Criterion 5 Safety-related structures, systems, and Structures, systems, and components important to safety shall not be shared among components (SSCs) are not shared 5 nuclear power units unless it can be shown that such sharing will not significantly between irradiation units unless it can be impair their ability to perform their safety functions, including, in the event of an shown that such sharing will not accident in one unit, an orderly shutdown and cooldown of the remaining units.
significantly impair their ability to perform their safety functions.
© SHINE Technologies, LLC 7
Generally-Applicable Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 19 A control room shall be provided from which actions can be taken to operate the nuclear Control room power unit safely under normal conditions and to maintain it in a safe condition under A control room is provided from accident conditions, including loss-of-coolant accidents. Adequate radiation protection shall which actions can be taken to be provided to permit access and occupancy of the control room under accident conditions operate the irradiation units safely 6 without personnel receiving radiation exposures in excess of 5 rem whole body, or its under normal conditions and to equivalent to any part of the body, for the duration of the accident. Equipment at appropriate perform required operator actions locations outside the control room shall be provided (1) with a design capability for prompt under postulated accident hot shutdown of the reactor, including necessary instrumentation and controls to maintain the conditions.
unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.
7 Chemical protection 10 CFR 70.64(a)(5) 8 Emergency capability 10 CFR 70.64(a)(6)
© SHINE Technologies, LLC 8
Subcritical Assembly Design Criteria Criterion SHINE Design Criteria Basis Subcritical assembly design 10 CFR 50 Appendix A, Criterion 10 The subcritical assembly system, target solution vessel (TSV) off- The reactor core and associated coolant, control, and gas system, and primary closed loop cooling system are designed protection systems shall be designed with appropriate 9
with appropriate margins to assure that target solution design limits margin to assure that specified acceptable fuel design limits are not exceeded during conditions of normal operation, including are not exceeded during any condition of normal operation, the effects of anticipated transients. including the effects of anticipated operational occurrences.
10 CFR 50 Appendix A, Criterion 11 Subcritical assembly inherent protection The reactor core and associated coolant systems shall be The subcritical assembly system is designed so that the net effect 10 designed so that in the power operating range the net effect of the prompt inherent nuclear feedback characteristics tends to of the prompt inherent nuclear feedback characteristics compensate for a rapid increase in reactivity.
tends to compensate for a rapid increase in reactivity.
10 CFR 50 Appendix A, Criterion 12 Suppression of subcritical assembly power oscillations The reactor core and associated coolant, control, and The subcritical assembly system is designed to ensure that power protection systems shall be designed to assure that power 11 oscillations that can result in conditions exceeding target solution oscillations which can result in conditions exceeding design limits can be reliably and readily detected and suppressed. specified acceptable fuel design limits are not possible or can be reliably and readily detected and suppressed.
© SHINE Technologies, LLC 9
Subcritical Assembly Design Criteria Criterion SHINE Design Criteria Basis Reactivity limits 10 CFR 50 Appendix A, Criterion 28 The target solution vessel (TSV) off-gas system, primary closed The reactivity control systems shall be designed with loop cooling system, and the TSV fill subsystem are designed with appropriate limits on the potential amount and rate of appropriate limits on the potential amount and rate of reactivity reactivity increase to assure that the effects of postulated increase to ensure that the effects of postulated reactivity accidents reactivity accidents can neither (1) result in damage to the can neither (1) result in damage to the primary system boundary reactor coolant pressure boundary greater than limited local 12 greater than limited local yielding nor (2) sufficiently disturb the TSV, yielding nor (2) sufficiently disturb the core, its support its support structures or other TSV internals to impair significantly structures or other reactor pressure vessel internals to the capability to drain the TSV. These postulated reactivity impair significantly the capability to cool the core. These accidents include consideration of excess target solution addition, postulated reactivity accidents shall include consideration of changes in primary cooling temperature, changes in primary system rod ejection (unless prevented by positive means), rod pressure, and deflagration or detonation in the primary system dropout, steam line rupture, changes in reactor coolant boundary. temperature and pressure, and cold water addition.
© SHINE Technologies, LLC 10
Instrumentation, Control, and Protection Systems Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 13 13 Instrumentation and controls 10 CFR 70.64(a)(10) 14 Protection system functions 10 CFR 50 Appendix A, Criterion 20 10 CFR 50 Appendix A, Criterion 21 15 Protection system reliability and testability 10 CFR 70.64(a)(8) 16 Protection system independence 10 CFR 50 Appendix A, Criterion 22 17 Protection system failure modes 10 CFR 50 Appendix A, Criterion 23 18 Separation of protection and control systems 10 CFR 50 Appendix A, Criterion 24 19 Protection against anticipated transients 10 CFR 50 Appendix A, Criterion 29
© SHINE Technologies, LLC 11
Primary System Boundary Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 14 Primary system boundary The reactor coolant pressure boundary shall be designed, The primary system boundary is designed, fabricated, erected, 20 fabricated, erected, and tested so as to have an extremely low and tested to have an extremely low probability of abnormal probability of abnormal leakage, of rapidly propagating failure, leakage, of rapidly propagating failure, and of gross rupture.
and of gross rupture.
10 CFR 50 Appendix A, Criterion 15 Primary closed loop cooling system design The reactor coolant system and associated auxiliary, control, The primary closed loop cooling system is designed with and protection systems shall be designed with sufficient sufficient margin to ensure that the design conditions of the 21 margin to assure that the design conditions of the reactor primary system pressure boundary are not exceeded during coolant pressure boundary are not exceeded during any any condition of normal operation, including anticipated condition of normal operation, including anticipated operational transients.
occurrences.
22 Quality of primary system boundary 10 CFR 50 Appendix A, Criterion 30 23 Fracture prevention of primary system boundary 10 CFR 50 Appendix A, Criterion 31 24 Inspection of primary system boundary 10 CFR 50 Appendix A, Criterion 32
© SHINE Technologies, LLC 12
Primary System Boundary Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 34 A system to remove residual heat shall be provided. The system safety Residual heat removal function shall be to transfer fission product decay heat and other residual heat The light water pool is provided to remove from the reactor core at a rate such that specified acceptable fuel design limits residual heat. The system safety function is to and the design conditions of the reactor coolant pressure boundary are not transfer fission product decay heat and other exceeded.
25 residual heat from the target solution vessel Suitable redundancy in components and features, and suitable dump tank at a rate such that target solution interconnections, leak detection, and isolation capabilities shall be provided to design limits and the primary system boundary assure that for onsite electric power system operation (assuming offsite power design limits are not exceeded. is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.
Cooling water 10 CFR 50 Appendix A, Criterion 44 The radioisotope process facility cooling system A system to transfer heat from structures, systems, and components important and process chilled water system are provided 26 to safety, to an ultimate heat sink shall be provided. The system safety function to transfer heat from safety-related SSCs to the shall be to transfer the combined heat load of these structures, systems, and environment, which serves as the ultimate heat components under normal operating and accident conditions.
sink.
© SHINE Technologies, LLC 13
Electric Power Systems Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 17 An onsite electric power system and an offsite electric power system shall The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under 27 Electric power systems operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integrity, and other vital safety functions are maintained.
Provisions shall be included to Inspection and testing 28 of electric power 10 CFR 50 Appendix A, Criterion 18 systems
© SHINE Technologies, LLC 14
Confinement and Control of Radioactivity Design Criteria Criterion SHINE Design Criteria Basis Confinement design Confinement boundaries are provided to establish a low-leakage barrier against the uncontrolled release of 10 CFR 50 Appendix A, Criterion 16 radioactivity to the environment and to assure that Reactor containment and associated systems shall be provided to confinement design leakage rates are not exceeded for establish an essentially leak-tight barrier against the uncontrolled 29 as long as postulated accident conditions require. Four release of radioactivity to the environment and to assure that the classes of confinement boundaries are established:
containment design conditions important to safety are not exceeded
- 1) the primary confinement boundary, for as long as postulated accident conditions require.
- 2) the process confinement boundary,
- 3) hot cells and gloveboxes, and
- 4) radiologically-controlled area ventilation isolations
© SHINE Technologies, LLC 15
Confinement and Control of Radioactivity Design Criteria Criterion SHINE Design Criteria Basis 10 CFR 50 Appendix A, Criterion 50 The reactor containment structure, including access openings, penetrations, and the containment heat removal system shall be designed so that the containment structure and its internal compartments can accommodate, without exceeding the design leakage rate and with sufficient margin, the calculated pressure and Confinement design basis temperature conditions resulting from any loss-of-coolant accident. This margin Each confinement boundary is designed to 30 shall reflect consideration of (1) the effects of potential energy sources which have withstand the conditions generated during not been included in the determination of the peak conditions, such as energy in postulated accidents.
steam generators and as required by § 50.44 energy from metal-water and other chemical reactions that may result from degradation but not total failure of emergency core cooling functioning, (2) the limited experience and experimental data available for defining accident phenomena and containment responses, and (3) the conservatism of the calculational model and input parameters.
Fracture prevention of confinement 10 CFR 50 Appendix A, Criterion 51 boundary The reactor containment boundary shall be designed with sufficient margin to Each confinement boundary design assure that under operating, maintenance, testing, and postulated accident reflects consideration of service conditions (1) its ferritic materials behave in a nonbrittle manner and (2) the 31 temperatures and other conditions of the probability of rapidly propagating fracture is minimized. The design shall reflect confinement boundary material during consideration of service temperatures and other conditions of the containment operation, maintenance, testing, and boundary material during operation, maintenance, testing, and postulated accident postulated accident conditions to prevent conditions, and the uncertainties in determining (1) material properties, (2) residual, fracture of the confinement boundary. steady state, and transient stresses, and (3) size of flaws.
© SHINE Technologies, LLC 16
Confinement and Control of Radioactivity Design Criteria Criterion SHINE Design Criteria Basis 32 Provisions for confinement testing and inspection 10 CFR 50 Appendix A, Criteria 52 and 53 Piping systems penetrating confinement Piping systems penetrating confinement boundaries that have the potential for excessive leakage are provided with isolation capabilities appropriate to the 10 CFR 50 Appendix A, Criterion 54 potential for excessive leakage.
Piping systems penetrating containment Piping systems that pass between confinement 10 CFR 50 Appendix A, Criterion 55 boundaries are equipped with either:
Reactor coolant pressure boundary penetrating containment 33 1) a locked closed manual isolation valve, or 10 CFR 50 Appendix A, Criterion 56
- 2) an automatic isolation valve that takes the position Primary containment isolation that provides greater safety upon loss of actuating 10 CFR 50 Appendix A, Criterion 57 power.
Closed system isolation valves Manual isolation valves are maintained locked-shut for any conditions requiring confinement boundary integrity.
© SHINE Technologies, LLC 17
Confinement and Control of Radioactivity Design Criteria Criterion SHINE Design Criteria Basis Confinement isolation Lines from outside confinement that penetrate the primary confinement boundary and are connected directly to the primary system boundary are provided with redundant isolation capabilities.
Ventilation, monitoring, and other systems that penetrate the primary, process, glovebox or hot cell confinement boundaries, are connected directly to the confinement atmosphere and are not normally locked closed, have redundant isolation capabilities or are otherwise directed to structures, systems, and 34 10 CFR 50 Appendix A, Criteria 55 and 56 components capable of handling any leakage.
Isolation valves outside confinement boundaries are located as close to the confinement as practical and upon loss of actuating power, automatic isolation valves are designed to take the position that provides greater safety. Manual isolation valves are maintained locked-shut for any conditions requiring confinement boundary integrity.
All electrical connections from equipment external to the confinement boundaries are sealed to minimize air leakage.
35 Control of releases of radioactive materials to the environment 10 CFR 50 Appendix A, Criterion 60 36 Target solution storage and handling and radioactivity control 10 CFR 50 Appendix A, Criterion 61
© SHINE Technologies, LLC 18
Confinement and Control of Radioactivity Design Criteria Criterion SHINE Design Criteria Basis Criticality control Criticality in the facility is prevented by physical systems or processes and the 10 CFR 50 Appendix A, Criterion 62 use of administrative controls. Use of geometrically safe configurations is 10 CFR 70.61(b) and (d) 37 preferred. Control of criticality adheres to the double contingency principle. 10 CFR 70.64(a)(9)
A criticality accident alarm system to detect and alert facility personnel of an 10 CFR 70.24(a) inadvertent criticality is provided.
38 Monitoring radioactivity releases 10 CFR 50 Appendix A, Criterion 64 Hydrogen mitigation Systems to control the buildup of hydrogen that is released into the primary 39 system boundary and tanks or other volumes that contain fission products and Unique SHINE design criterion produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries are maintained.
© SHINE Technologies, LLC 19
Advisory Committee on Reactor Safeguards SHINE Medical Technologies, LLC Operating License Application Chapter 3.1 - Design Criteria Duane Hardesty Sr. Project Manager Office of Nuclear Reactor Regulation July 19, 2022
Design Criteria
- The FSAR must specify the design criteria for the facility structures, systems, and components (SSCs) that are assumed in the SAR to perform an operational or safety function.
- Establish the necessary design, fabrication, construction, testing, and performance requirements for SSCs important to safety that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public.
- The design criteria must include applicable standards, guides, and codes to support that the SSCs will function as designed as required by the safety analyses.
2
Regulatory Basis
- Regulatory Requirements
- 10 CFR 50.34, Contents of applications; technical information
- 10 CFR 50.40, Common standards
- 10 CFR 50.57, Issuance of operating license 3
Acceptance Criteria
- NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996;
- NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996;
- Final Interim Staff Guidance (ISG) Augmenting NUREG-1537, Part 1 and Part 2, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors 4
Review Procedures and Technical Evaluation
- A review of the technical information presented in SHINE FSAR to assess the sufficiency of the principal design criteria for the SHINE facility and its safety-related SSCs for the protection of the public and the environment in support of the issuance of an operating license.
- The sufficiency of the design criteria is determined by ensuring that SHINE meets applicable regulatory requirements, guidance, and acceptance criteria, as discussed in Section 3.3, Regulatory Requirements and Guidance and Acceptance Criteria, of the SER.
- The findings of the staff review are described in SER Section 3.5, Review Findings.
5
SHINEs Design Criteria
- For each SSC, FSAR Tables 3.1-1 Safety-Related Structures, Systems, and Components, and Table 3.1-2, Nonsafety-Related Structures, Systems, and Components identify the applicable FSAR section or sections that describe each SSC.
- SHINE discusses design criteria for individual SSCs in the applicable FSAR section describing those SSCs.
- Similarly, the NRC staff evaluation, as applicable to the specific design criteria, is included within the chapter of the SE where the staff evaluated those SSCs.
- Section 3 of the NRC staffs evaluation discusses the acceptability of SHINEs general design criteria (1-8) identified in Table 3.1-3, SHINE Design Criteria, and of the Nuclear Safety Classification, as described in FSAR Section 3.1.
6
NRC Staff Observations
- The SHINE design criteria follows Appendix A to Part 50, General Design Criteria for Nuclear Power Plants and 10 CFR 70.64(a)
Design criteria.
Not all the GDC apply to SHINEs use of low enriched uranium (LEU) in the form of a uranyl sulfate target solution that is irradiated in a subcritical assembly by neutrons produced by a fusion neutron source.
Additionally, as discussed in Chapter 7 of the staffs SE, the application specific action items (ASAIs) in the NRC topical report on the HIPS platform are intended for power reactor applications and not all ASAIs are critical for ensuring safety in SHINEs application of the HIPS platform for the TRPS and ESFAS.
- The SHINE nuclear safety criteria are based on the 10 CFR 70.61, Performance requirements and the ISG to NUREG-1537.
7
SHINE Facility Nuclear Safety Criteria To demonstrate that the principal design criteria are adequate, SHINE states in FSAR Section 3.1 that acceptable risk is achieved by ensuring that all postulated events are highly unlikely or by reducing the consequences to less than the SHINE safety criteria
- The SHINE safety criteria:
An acute worker dose of five rem or greater total effective dose equivalent (TEDE)
An acute dose of 1 rem or greater TEDE to any individual located outside the owner-controlled area An intake of 30 milligrams or greater of uranium in a soluble form by any individual located outside the owner-controlled area Criticality where fissionable material is used, handled, or stored (with the exception of the target solution vessel)
Loss of capability to reach safe shutdown conditions 8
General Design Criteria Consistent with the guidance in NUREG-1537, the SHINE FSAR includes the following eight general design criterion:
- Criterion 1- Quality standards and records
- Criterion 2 - Natural phenomena hazards
- Criterion 3 - Fire protection
- Criterion 4 - Environmental and dynamic effects
- Criterion 5 - Sharing of structure, systems, and components
- Criterion 6 - Control room
- Criterion 7 - Chemical protection
- Criterion 8 - Emergency capability 9
Evaluation Findings and Conclusions
- Design criteria is provided for each SSC that is assumed in the FSAR to perform an operational or safety function.
- Design criteria includes references, as appropriate, to applicable standards, guides, and codes.
- Descriptions of the design are included in the section of the FSAR that corresponds to the specific SSC and generally include the following:
Design for the complete range of normal expected operating conditions.
Design to cope with anticipated transients and potential accidents.
Design redundancy, so that any single failure of any active component will not prevent safe shutdown or result in an unsafe condition.
Design to facilitate inspection, testing, and maintenance.
10
Evaluation Findings and Conclusions (cont.)
- Descriptions of the design are included in the section of the FSAR that corresponds to the specific SSC and generally include the following (continued):
Design provisions to avoid or mitigate fires, explosions, and potential man-made or natural conditions Quality standards commensurate with the safety function and the potential risks.
Design requirements necessary to ensure the availability and operability of required SSCs.
11
12 Hydrogen Mitigation
- SHINE Design Criteria No. 39 (Facility Unique)
Systems to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen are provided to ensure that the integrity of the system and confinement boundaries are maintained.
Radiological ventilation zones 1, 2, & 3 (RVZ) [9a.2.1]
Subcritical assembly system (SCAS) [4a.2]
Target solution staging system (TSSS) [4b.1.3, 4b.4, 9b.2.4]
TSV off-gas system (TOGS) [4a.2]
TSV reactivity protection system (TRPS) [7.4]
Vacuum transfer system (VTS) [4b.1.3, 9b.2.5]
- Three systems are provided to mitigate hydrogen generation:
TOGS SCAS gas management Process vessel vent system (PVVS) RPF Tanks Nitrogen Purge system (N2PS) RPF distribution header 13
Fire Protection ANDREW MEYER, SAFETY ANALYSIS MANAGER
© SHINE
© SHINE Technologies, Technologies, LLC LLC 1
Outline Fire Protection Program Fire Hazards Analysis Safe Shutdown Analysis Fire Modeling Pre-Fire Plans
© SHINE Technologies, LLC 2
Fire Protection Program Objective of the fire protection program is to minimize the probability and consequences of fires in the SHINE facility o Elements of the fire protection program work together to satisfy the requirements to 10 CFR 50.48(a)
The fire protection program takes a defense-in-depth approach o Prevent fires from starting, including limiting combustible materials o Detect, control, and extinguish fires which do occur, to limit consequences o Provide protection for systems, structures, and components (SSCs) important to safety so that a fire will not prevent the safe shutdown of the irradiation units (IUs) or cause an uncontrolled release of radioactive material to the environment
© SHINE Technologies, LLC 3
Fire Hazards Analysis Establishes and describes individual facility fire areas, which are unique areas separated by fire rated construction or administrative controls to prevent the spread of fire between adjacent fire areas Determines the fire hazard posed by operations and contents of each fire area o Hazards included combustible materials and ignition sources Along with the safe shutdown analysis, determines worst-case fire effects on safe shutdown capability and the potential for uncontrolled release of radioactive materials Evaluates the adequacy of fire protective features (e.g., fire prevention, barriers, detection, suppression) and any need for additional protection Analysis is supported by a combustible loading calculation, quantifying the heat load (in BTU/sq. ft.) of combustibles installed or stored in each fire area in the radiologically controlled area (RCA)
© SHINE Technologies, LLC 4
Safe Shutdown Analysis Demonstrates a means of safe shutdown of the IUs to ensure they can be placed and maintained in a safe and stable condition following a safe shutdown fire in any facility fire area.
o Also demonstrates the capability of safety-related equipment to prevent uncontrolled releases of radioactive material as a result of fire Performance goals of the safe shutdown analysis:
o Reactivity shall be maintained subcritical in the event of a fire o Combustible gas control systems shall be capable of performing their necessary functions in the event of a fire o Target solution cooling shall be capable of removing heat such that target solution boiling does not occur o Uncontrolled release of radioactive material shall be prevented Equipment credited with a safe shutdown function (including components designed and credited to isolate areas containing radioactive materials) are identified as part of the analysis
© SHINE Technologies, LLC 5
Safe Shutdown Analysis Analysis is performed on a per-fire area basis o Redundant trains of safety-related equipment are demonstrated to be separated such that a single fire cannot impair a safe shutdown function Primary separation criteria is fire-resistant barriers between redundant trains (i.e., redundant equipment located in different fire areas)
Where redundant equipment is located in the same fire area, the following separation criteria are used in a qualitative assessment:
o Spatial separation distance of at least 20 feet where automatic fire suppression is provided and at least 40 feet where automatic fire suppression is not provided o Embedment of cable conduit in structural concrete o Fixed fire suppression and/or detection in the fire area o Areas which have restricted access and/or are sealed o Areas which are continuously occupied o Administrative controls on combustible loading Where these separation criteria cannot be met as determined by analysis, fire modeling is performed to determine if both trains of equipment can be damaged by a single fire
© SHINE Technologies, LLC 6
Fire Modeling Quantitative fire modeling is performed using the Consolidated Model of Fire and Smoke Transport (CFAST) code to support the fire hazards analysis and safe shutdown analysis Two scenarios of concern are modeled:
o Fire involving a neutron driver high-voltage power supply (HVPS) and nearby cables o Fire involving the target solution vessel (TSV) off-gas system (TOGS) motor control centers (MCCs)
HVPS fire:
o Objective: determine if a fire involving a HVPS could impact the structural members of the building (specifically the steel roof trusses and steel bridge crane rails)
CFAST used to determine the hot gas layer temperature and temperature of targets used to represent structural elements o Sources of combustibles: Dielectric oil in a transformer and cables in nearby cable trays o Damage criteria: 593°C (critical temperature of steel) o
Conclusion:
hot gas layer temperature at target areas is less than the damage criteria (i.e., less than the critical temperature of steel)
© SHINE Technologies, LLC 7
Fire Modeling TOGS MCC fire:
o Objective: determine the distance (vertical and lateral) where critical temperatures are exceeded to determine whether a single fire can impact both TOGS MCCs CFAST used to determine the Zone of Influence (ZOI) of TOGS MCC fire and transient fire in the TOGS MCC hallway o Sources of combustible: cables in an MCC and transient fires o Damage criteria: 205°C (based on thermal damage criteria for thermoplastic cables)
This bounds damage criteria for bulk cables (critical temperature of 500°C) o
Conclusion:
critical temperature at Division A MCC not reached by fire in a Division B MCC (and vice versa) and cables in raceways above MCCs are not ignited
© SHINE Technologies, LLC 8
Pre-Fire Plans Pre-fire plans are developed for areas of the main production facility to provide information for trained facility personnel and responding professional firefighters Plans include the following information, as appropriate:
o Area identification o Physical hazards o Emergency contact information o Exposure protection guidance o Occupancy/processes o Communications o Fire hazards o Access/egress routes o Radiation hazards o Ventilation o Electrical information (electrical disconnect) o Fixed fire systems o Hazardous substances o Portable firefighting equipment
© SHINE Technologies, LLC 9
Advisory Committee on Reactor Safeguards SHINE Medical Technologies, LLC Operating License Application Chapter 9a2.3 - Fire Protection Systems and Programs Jay Robinson Fire Protection Technical Reviewer Office of Nuclear Reactor Regulation July 19, 2022
Fire Protection Systems and Programs
- Fire protection for nuclear facilities uses the defense-in-depth (DID) concept to achieve the required degree of safety by using echelons of administrative controls, fire protection systems and features, and post-fire safe-shutdown capability.
- Fire Protection DID is designed to:
- Prevent fires from starting, including limiting combustible materials;
- Detect, control, and extinguish those fires that do occur to limit consequences; and
- Provide protection for structures, systems, and components (SSCs) important to safety so that a continuing fire will not prevent the safe shutdown of the irradiation units (IUs) or cause an uncontrolled release of radioactive material to the environment.
2
Fire Protection Systems and Programs
- A fire protection plan is required. The fire protection plan:
- Describes the overall fire protection program (FPP) for the facility.
- Outlines the programs for fire protection, automatic fire detection and suppression capability, and limitations of fire damage.
- Describes specific features necessary to implement the program, such as administrative controls and personnel requirements for fire prevention and manual fire suppression activities.
- Describes the means to limit fire damage to SSCs important to safety, including those that are safety-related so that the capability to safely shutdown the plant is ensured.
3
Regulatory Basis
- 10 CFR 50.48(a), fire protection. Requires a fire protection plan that:
- Describes the FPP.
- Identifies positions responsible for the program and authorities delegated to those positions.
- Outlines plans for fire protection, fire detection and suppression capability, and limitation of fire damage.
- Describes administrative controls and personnel requirements for fire prevention and manual fire suppression activities.
- Describes automatic and manually operated fire detection and suppression systems.
- Describes the means to limit fire damage to SSCs important to safety to ensure safe shutdown.
4
Regulatory Basis
- Criterion 3, Fire protection, of Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50.
- SSCs important to safety shall be designed and located to minimize the probability and effect of fires and explosions.
- Noncombustible and heat resistant materials shall be used wherever practical.
- Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on SSCs important to safety.
- Firefighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these SSCs.
5
Acceptance Criteria
- NUREG-1537, Parts 1 and 2
- Final Interim Staff Guidance Augmenting NUREG-1537, Parts 1 and 2
- Fire protection acceptance criteria describes:
- The prevention of fires, including limiting the types and quantities of combustible materials.
- Methods to detect, control, and extinguish fires.
- That the facility should be designed and protective systems should exist to ensure a safe shutdown and prevent the uncontrolled release of radioactive material if a fire should occur.
6
Acceptance Criteria
- The SAR should contain sufficient information to support the following types of conclusions:
- Facility meets local and national fire and building codes.
- Fire protection systems can function as described and limit drainage and consequences at any time.
- There is reasonable assurance that training for fire protection is adequately planned.
- The potential radiological consequences of a fire will not prevent safe shutdown, and any fire-related release of radioactive material from the facility to the unrestricted environment has been adequately addressed.
- Release of radioactive material from fire would not cause radiation exposures that exceed the requirements of 10 CFR Part 20.
- Fire Protection technical specifications have been developed (as applicable).
7
Review Process and Technical Evaluation
- Additional Licensee Supporting Documents:
- Fire Hazards Analysis
- Fire Detection and Suppression Design Criteria Documents
- Safe Shutdown Analysis
- Combustible Loading Calculation
- Detailed Fire Modeling
- Fire Protection Impact Review
- Draft Procedures for Combustible Controls, Control of Ignition Sources, Housekeeping
- Fire Protection Pre-Fire Plans
- Radiological Dose Consequences 8
Review Process and Technical Evaluation
- Requests for Additional Information
- Licensee Clarified Information Regarding
- Fire Brigade and Manual Firefighting Capability
- Operator Actions
- Fire Protection Change Control Process
- Construction Elements
- Safe Shutdown Analysis
- Fire Protection Administrative Controls
- Codes of Records
- Code Deviations
- Radiological Consequences 9
Evaluation Findings and Conclusions
- Fire protection-related SSCs and DID controls are designed, constructed, and used consistent with good engineering practice, which dictates that certain minimum requirements be applied as design and safety considerations for any new nuclear material process or facility.
- There is reasonable assurance that the fire protection systems and programs are in conformance with NUREG-1537, Parts 1 and 2.
10
Evaluation Findings and Conclusions
- There is reasonable assurance that the facility meets the requirements of 10 CFR 50.48(a) and Criterion 3 of Appendix A to 10 CFR Part 50.
- There is reasonable assurance that a fire in any plant area during any operational mode and plant configuration will not prevent the plant from achieving safe shutdown and maintaining a safe and stable condition and will also not cause radiation exposures that exceed the requirements of 10 CFR Part 20.
11
Implementation of the Highly Integrated Protection System JASON POTTORF, DIRECTOR OF ENGINEERING, ROCK CREEK INNOVATIONS
© SHINE
© SHINE Technologies, Technologies, LLC LLC 1
Outline Target Solution Vessel Reactivity Protection System (TRPS) and Engineered Safety Features Actuation System (ESFAS) Architecture Highly Integrated Protection System (HIPS) Platform Changes
© SHINE Technologies, LLC 2
TRPS and ESFAS Architecture
© SHINE Technologies, LLC 3
TRPS and ESFAS Architecture Architectural Differences compared to NuScale:
o Function of Scheduling and Bypass Modules (SBMs) and Scheduling and Voting Modules (SVMs) is performed by a single module (Scheduling, Bypass, and Voting Modules [SBVM]) within Divisions A and B o Created two new modules which are simple variants of existing HIPS platform modules (Remote Input Submodules [RISMs] and Gateway Communication Modules [GWCMs])
RISM used to provide neutron flux input to a respective Safety Function Module (SFM)
GWCM used to aggregate multiple divisions of monitoring and indications information and provide it to the nonsafety-related control system o Three divisions of input signal conditioning and trip determination (A, B, C) with two divisions of voting and actuation (A and B) o Three different field programmable gate arrays (FPGAs) used - one for each of Divisions A, B, and C Division A - Microsemi Flash type FPGA Division B - Xilinx SRAM type FPGA Division C - Intel Flash type FPGA
© SHINE Technologies, LLC 4
TRPS and ESFAS Architecture Division C RISM 1 RISM 2 SFM 1 SFM 2 SFM n SBM 1 SBM 2 SBM 3 Note: Overall architecture applies to both the TRPS and ESFAS, however the RISMs are only used in the TRPS.
Division A Division B SBVM1 SBVM2 SBVM3 SBVM1 SBVM2 SBVM3 SFM 1 SFM 2 SFM n EIM 1 EIM 2 EIM n SFM 1 SFM 2 SFM n EIM 1 EIM 2 EIM n RISM 1 RISM 2 RISM 1 RISM 2
© SHINE Technologies, LLC 5
HIPS Platform Changes
© SHINE Technologies, LLC 6
HIPS Platform Changes Hardwired Module (HWM) input routing Use of fiber optic communications Communications Module bi-directional communications Number of Equipment Interface Module (EIM) switching outputs per module Scheduling, Bypass, and Voting Module (SBVM)
Remote Input Submodule (RISM)
Gateway Communication Module (GWCM)
Self-Testing o Input Submodule Analog-to-Digital Converter (ADC) o EIM input and output testing o HWM input channel test Module front panel light-emitting diodes (LEDs)
© SHINE Technologies, LLC 7
HIPS Platform Changes Hardwired Module input routing o Section 2.5.2 of the Topical Report (TR) states that Trip/Bypass switch inputs to the HWMs are routed only to the SBMs where it is used.
For SHINE, all signals input to the HWMs are made available on the backplane to all modules within the chassis where they are used only by those modules that need the specific signals This supports using some safety valve position feedback inputs for safety function actuation (in the SBVMs) and also confirmation of completion of the safety function (in the EIMs)
Use of fiber optic communications o Sections 2.5.3, 4.3, and 4.6.2 of the TR describe the use of fiber optic ports for inter-divisional transmit-only or receive-only communications.
For SHINE, all inter-divisional communications are implemented with copper RS-485 connections
© SHINE Technologies, LLC 8
HIPS Platform Changes Communications Module bi-directional communications o Section 2.5.3 of the TR describes transmit-only or receive-only communications for a Communications Module (CM).
For SHINE, the GWCM implements the MODBUS communications protocol Communications upstream of the GWCM are transmit-only from the Monitoring and Indication Communications Modules (MICMs) to the GWCMs All communications handled by the GWCMs are nonsafety related communications Number of EIM switching outputs per module o Section 2.5.4.4 of the TR states that each EIM can control two groups of field components and each group can have up to two field devices For SHINE, each EIM can control four groups of field components and each group can have up to two field devices
© SHINE Technologies, LLC 9
HIPS Platform Changes Scheduling, Bypass, and Voting Module o Throughout the TR, the use of SBMs and SVMs (two types of a communications module) is discussed as part of the representative architecture.
For SHINE, the SBVM communications module combines all functions, capabilities, and design principles described in the TR for the SBM and SVM into a single module.
For SHINE, Figure 7-8 of the TR is modified to show: (1) only three divisions; (2) the Wait for Sync is not necessary for the SBVMs; and (3) the voting is different (not 2oo4 voting).
For SHINE, Figure 7-12 of the TR is modified to show that all safety function groups (SFGs) are voted on at the same time and the trip determination actuation (TDA) for all SFGs are then transferred to the EIMs at once instead of sending separate TDA information for each SFG to the EIMs.
© SHINE Technologies, LLC 10
HIPS Platform Changes For SHINE, Figure 7-14 of the TR is modified simply to show the SBM and SVM functionality being performed by the SBVM module (dashed box).
© SHINE Technologies, LLC 11
HIPS Platform Changes Remote Input Submodule o New module not discussed in the TR o Each RISM is directly associated with a single Safety Function Module (SFM) and allows for remotely locating one Input Submodule (ISM) from its associated SFM o The ISM on a RISM is the same as described in the TR with the self-testing/ADC modification (described on next slide) o The ISM on a RISM can be configured for a specific input type and calibrated as described in the TR for the SFM o The RISM includes communications module capabilities necessary to provide the input data via an isolated, one-way RS-485 connection to its associated SFM within the division o An additional RS-485 connection between the RISM and its associated SFM is provided to support modification of tunable parameters on the RISM
© SHINE Technologies, LLC 12
HIPS Platform Changes Gateway Communication Module (GWCM) o New type of communications module not discussed in the TR which utilizes two-way MODBUS communications o Similar to an MICM and performs only nonsafety-related monitoring and indication (M&I) functions o Receives M&I data via one-way isolated RS-485 connection from multiple MICMs o One communications port is configured for MODBUS communications with the respective PICS channel to provide aggregated M&I data
© SHINE Technologies, LLC 13
HIPS Platform Changes Self-Testing o Input Submodule Analog-to-Digital Converter Sections 7.1.1 and 8.2.1 of the TR describe the self-testing features for the ADC for an analog input submodule (ISM)
The auto-calibration function described included the use of external passive components, whereas the TRPS and ESFAS designs will incorporate the critical passive components onto the ADC chip Results in very precise values that are factory calibrated and are significantly less prone to drift over time and temperature o EIM input and output testing The self-testing described in Sections 8.2.3.2 and 8.2.3.4 of the TR for discrete input circuitry (open/closed contact tests) and high drive output testing not being implemented for the TRPS and ESFAS designs This implementation would require interaction between the FPGA logic and the analog actuation priority logic (APL) circuitry, and it was desired to keep the interface between the FPGA and APL as simple as possible o HWM input channel test The self-testing identified in Section 8.2.7 of the TR for HWM input signals is not being implemented for the TRPS and ESFAS designs This implementation would require interaction of the FPGA with the hardwired input circuitry (used for manual protection system actuation) and it was desired to not allow any interface of the FPGA with this capability
© SHINE Technologies, LLC 14
HIPS Platform Changes Module front panel LEDs o Section 8.2.7 of the TR identifies that LED tests will be performed to identify if an incorrect LED status is being displayed These tests will not be performed on a continuous basis for the TRPS and ESFAS designs for the following reasons:
o Module front panel indication is not a safety function; and o Correct LED operation will be tested as part of factory and installation testing.
o Section 8.4 of the HIPS platform topical report describes the two LEDs on the front of each HIPS module which are used to indicate the state of the module latches, the operational state of the module, and the presence of any faults for the module o The TRPS and ESFAS designs will include the following changes to the function of the LEDs from that presented in the TR:
The ACTIVE LED will turn Red on a vital fault or when the module has one latch open The FAULT LED will never flash and not turn Red The FAULT LED will turn Yellow for any fault (non-vital or vital)
© SHINE Technologies, LLC 15
Target Solution Vessel Reactivity Protection System and Engineered Safety Features Actuation System (Open Session)
TRACY RADEL, VICE PRESIDENT OF ENGINEERING
© SHINE
© SHINE Technologies, Technologies, LLC LLC 1
Outline Target Solution Vessel (TSV) Reactivity Protection System (TRPS) o Overview o Functions and Monitored Variables o Mode transitions, Permissives, and Bypasses Engineered Safety Features Actuation System (ESFAS) o Overview o Functions and Monitored Variables Priority Logic TRPS/ESFAS Interfaces with the Process Integrated Control System (PICS)
© SHINE Technologies, LLC 2
Overview of the TRPS Designed using the highly integrated protection system (HIPS) platform Monitors variables important to safety functions of the irradiation process Performs various safety functions as required by SHINE safety analysis Consists of eight independent instances of TRPS, each dedicated to one irradiation unit (IU)
Three divisions of monitoring equipment with two-out-of-three coincident logic vote Nine cabinets in total:
o Three cabinets for IU Cells 1 and 2 (Division A, Division B, and Division C) o Three cabinets for IU Cells 3 through 5 (Division A, Division B, and Division C) o Three cabinets for IU Cells 6 through 8 (Division A, Division B, and Division C)
© SHINE Technologies, LLC 3
TRPS Functions Safety Functions o IU Cell Safety Actuation o IU Cell Nitrogen Purge o IU Cell Tritium Purification System (TPS) Actuation o Driver Dropout Nonsafety Function o Fill Stop
© SHINE Technologies, LLC 4
IU Cell Safety Actuation Initiated based on process variables indicating:
o Insertion of excess reactivity o Loss of cooling o Overcooling o Loss of hydrogen recombination capability o Breach of the primary system boundary Transitions the unit to Mode 3, shutting down the irradiation process o Opens the TSV dump valves and neutron driver assembly system (NDAS) high voltage power supply (HVPS) breakers Isolates the primary system boundary and primary confinement boundary
© SHINE Technologies, LLC 5
IU Cell Nitrogen Purge Initiated based on process variables indicating:
o Loss of hydrogen recombination capability Isolates radioisotope process facility cooling system (RPCS) to limit water intrusion Purges the primary system boundary for the affected IU with nitrogen o Opens nitrogen purge and vent isolation valves
© SHINE Technologies, LLC 6
IU Cell TPS Actuation Initiated based on process variables indicating:
o Breach of the tritium boundary within the IU cell or supply/return lines o Breach of the tritium boundary in the TPS glovebox Isolates the TPS lines into and out of the IU cell Isolates the radiological ventilation zone 1 (RVZ1) exhaust out of the IU cell
© SHINE Technologies, LLC 7
Driver Dropout Initiated based on process variables indicating:
o Loss of neutron driver output o Loss of cooling Function 1: Loss of driver output o Opens NDAS HVPS breakers to terminate the irradiation process after time delay Function 2: Loss of cooling o Opens the NDAS HVPS breakers to terminate the irradiation process without delay o Initiates IU Cell Safety Actuation after 180 second delay
© SHINE Technologies, LLC 8
TRPS Monitored Variables and Response NEUTRON FLUX High source range neutron flux o Protects against an insertion of excess reactivity during the filling process o IU Cell Safety Actuation initiated when two-out-of-three or more signals active Low power range neutron flux o Protects against loss of the neutron beam followed by a restart of the neutron beam outside of analyzed conditions o Driver Dropout initiated when two-out-of-three or more signals active for predetermined amount of time High time-averaged neutron flux o Protects against exceeding analyzed TSV power levels during Modes 1 and 2 o IU Cell Safety Actuation initiated when two-out-of-three or more signals active High wide range neutron flux o Protects against exceeding target solution power density and temperature limits during Modes 1 and 2 o IU Cell Safety Actuation initiated when two-out-of-three or more signals active
© SHINE Technologies, LLC 9
TRPS Monitored Variables and Response COOLING SYSTEM High primary closed loop cooling system (PCLS) temperature o Protects against a loss of cooling that could cause target solution heat-up o IU Cell Safety Actuation initiated when two-out-of-three or more signals active for three minutes Low PCLS temperature o Protects against an overcooling of the target solution that could cause an excess reactivity insertion o IU Cell Safety Actuation initiated when two-out-of-three or more signals active Low PCLS flow o Protects against a loss of cooling that could cause target solution bulk boiling o IU Cell Safety Actuation initiated when two-out-of-three or more signals active for three minutes
© SHINE Technologies, LLC 10
TRPS Monitored Variables and Response TSV DUMP TANK Low-high TSV dump tank level o Protects against in-leakage into the primary system boundary during Mode 1 and 2 that could result in loss of TSV off-gas system (TOGS) flow to the TSV dump tank headspace o IU Cell Safety Actuation and IU Cell Nitrogen Purge initiated when two-out-of-three or more signals active High-high TSV dump tank level o Protects against in-leakage into the primary system boundary that could result in loss of TOGS flow to the TSV dump tank headspace o IU Cell Safety Actuation and IU Cell Nitrogen Purge initiated when two-out-of-three or more signals active
© SHINE Technologies, LLC 11
TRPS Monitored Variables and Response TOGS Low TOGS oxygen concentration o Protects against a deflagration in the primary system boundary caused by the inability to recombine hydrogen with oxygen o IU Cell Safety Actuation and IU Cell Nitrogen Purge initiated when two-out-of-three or more signals active Low TOGS mainstream flow o Protects against a deflagration in the primary system boundary caused by the inability to sweep accumulated hydrogen through the TOGS hydrogen recombiners o IU Cell Safety Actuation and IU Cell Nitrogen Purge initiated when two-out-of-three or more signals active Low TOGS dump tank flow o Protects against a deflagration in the TSV dump tank caused by an inability to remove accumulated hydrogen from tank o IU Cell Safety Actuation and IU Cell Nitrogen Purge initiated when two-out-of-three or more signals active High TOGS condenser demister outlet temperature o Protects against failure of the condenser-demister causing adverse effects on hydrogen recombination, TOGS instrumentation, or the zeolite beds o IU Cell Safety Actuation and IU Cell Nitrogen Purge initiated when two-out-of-three or more signals active
© SHINE Technologies, LLC 12
TRPS Monitored Variables and Response ADDITIONAL VARIABLES ESFAS loss of external power o Anticipatory protection against the impending loss of TOGS blowers and recombiners after the runtime of that equipment on the uninterruptible electrical power supply system (UPSS) has been exceeded o IU Cell Nitrogen Purge initiated upon receipt of discrete signal from ESFAS High RVZ1e IU cell exhaust radiation o Protects against a breach in the primary system boundary, limiting radiological release o IU Cell Safety Actuation initiated when two-out-of-three or more signals active TSV fill isolation valve position indication not closed o Protects against the inadvertent addition of target solution to the TSV o IU Cell Safety Actuation initiated when one-out-of-two or more signals active ESFAS IU cell TPS actuation o Protects against tritium release events in the TPS o IU Cell TPS Actuation initiated upon receipt of discrete signal from ESFAS
© SHINE Technologies, LLC 13
Mode Transition Permissives Mode 0 to Mode 1 o All TSV dump valve position indications and all TSV fill isolation valve position indications indicate valves are fully closed o TOGS mainstream flow is above the minimum flow rate Mode 1 to Mode 2 o TSV fill isolation valve position indications indicate both valves are fully closed Mode 2 to Mode 3 o All HVPS breaker position indications indicate the breakers are open Mode 3 to Mode 4 o IU Cell Safety Actuation is not present Mode 4 to Mode 0 o TSV dump tank level is below the low-high TSV dump tank level
© SHINE Technologies, LLC 14
Bypasses Mode 0: Mode 1:
o Low power range neutron flux o Low power range neutron flux o Low PCLS temperature o TSV fill isolation valve position indication not o High PCLS temperature closed o Low PCLS flow o Low PCLS flow o Low TOGS mainstream flow (Train A) (Train B) o High PCLS temperature o Low TOGS dump tank flow Mode 2:
o High TOGS condenser demister outlet o High source range neutron flux temperature (Train A) (Train B) o ESFAS loss of external power
© SHINE Technologies, LLC 15
Bypasses Mode 3: Mode 4 o High source range neutron flux o High source range neutron flux o Low power range neutron flux o Low power range neutron flux o High PCLS temperature o High PCLS temperature o Low PCLS temperature o Low PCLS temperature o Low PCLS flow o Low PCLS flow o Low-high TSV dump tank level o Low-high TSV dump tank level o TSV fill isolation valve position indication not o TSV fill isolation valve position indication not closed closed
© SHINE Technologies, LLC 16
Overview of the ESFAS Designed using the HIPS platform Monitors variables important to safety functions in the radioisotope production facility (RPF) and tritium systems Performs various design basis safety functions as required by SHINE safety analysis Three divisions of monitoring equipment with one-out-of-two or two-out-of-three coincident logic vote depending on operability considerations Three cabinets in total:
o Division A cabinet o Division B cabinet o Division C cabinet
© SHINE Technologies, LLC 17
ESFAS Safety Functions Radiologically Controlled Area (RCA) Isolation Supercell Isolation Carbon Delay Bed Isolation Vacuum Transfer System (VTS) Safety Actuation TPS Train Isolation TPS Process Vent Actuation IU Cell Nitrogen Purge RPF Nitrogen Purge Molybdenum Extraction and Purification System (MEPS) Heating Loop Isolation Extraction Column and Iodine and Xenon Purification and Packaging (IXP) Alignment Actuation Dissolution Tank Isolation
© SHINE Technologies, LLC 18
RCA Isolation Initiated based on process variables indicating:
o Fission product release into RVZ1 or radiological ventilation zone 1 (RVZ2) areas of the facility o Breach of the tritium boundary within an IU cell, supply/return lines, or a TPS glovebox Closes RVZ dampers and turns off blowers Initiates Supercell Area Isolations, VTS Safety Actuation, TPS Train Isolations, and TPS Process Vent Actuation
© SHINE Technologies, LLC 19
Supercell Isolation Initiated based on process variables indicating:
o Fission product release into a supercell area confinement Closes inlet and outlet dampers for the supercell area that is affected Initiates a VTS Safety Actuation if the release occurs in process vessel vent system (PVVS) or extraction areas Initiates a MEPS Heating Loop Isolation if the release occurs in an extraction area
© SHINE Technologies, LLC 20
Carbon Delay Bed Isolation Initiated based on process variables indicating:
o Fire in a PVVS carbon delay bed 1, 2, or 3 Isolates and bypasses impacted bed, suppressing fire while maintaining flow through other seven beds
© SHINE Technologies, LLC 21
VTS Safety Actuation Initiated based on process variables indicating:
o Break in the process boundary, either in the subgrade or the hot cells, where VTS operation could lead to increased radiological release Terminated vacuum lifting operations by opening the breakers and vacuum valves Isolates chemical reagent lines that penetrate the confinement boundary
© SHINE Technologies, LLC 22
TPS Train Isolation Initiated based on process variables indicating:
o Breach of the tritium boundary within an IU cell, supply/return lines, or a TPS glovebox Isolates the TPS glovebox Closes the TPS room dampers Initiates and IU Cell TPS Actuation, which isolates the TPS lines into and out of the IU cell
© SHINE Technologies, LLC 23
TPS Process Vent Actuation Initiated based on process variables indicating:
o High tritium in the process exhaust Closes the tritium process exhaust valves from all trains Initiates and IU Cell TPS Actuation, which isolates the TPS lines into and out of the IU cell
© SHINE Technologies, LLC 24
IU Cell Nitrogen Purge Initiated based on:
o Discrete signal from TRPS indicating loss of hydrogen recombination capability in one or more IU cells o Indication of loss of external power, following three-minute time delay Opens nitrogen purge system (N2PS) IU cell header valves N2PS valves to individual IU cells are opened by TRPS
© SHINE Technologies, LLC 25
RPF Nitrogen Purge Initiated based on process variables indicating:
o Loss of flow in PVVS Opens N2PS RPF header valves Opens PVVS carbon guard bed bypass valves
© SHINE Technologies, LLC 26
MEPS Heating Loop Isolation Initiated based on process variables indicating:
o Leak of target solution into MEPS heating loop o Break in the process boundary, either in the subgrade or the hot cells Closes isolation valves for MEPS heating loop Opens breakers for MEPS extraction column feed pump
© SHINE Technologies, LLC 27
Extraction Column and Iodine and IXP Alignment Actuation Initiated based on process variables indicating:
o Valve alignment that could lead to fissile material in a non-favorable geometry tank Aligns valves to safe position Criticality safety control
© SHINE Technologies, LLC 28
Dissolution Tank Isolation Initiated based on process variables indicating:
o Overflow of target solution preparation system (TSPS) dissolution tanks, potentially leading to fissile material in non-favorable geometry location Isolates tank inlets and outlets Isolates cooling water supply and return Criticality safety control
© SHINE Technologies, LLC 29
ESFAS Monitored Variables and Response EXHAUST RADIATION High RVZ1/2 RCA exhaust radiation o Protect against confinement leakage or accidents that could potentially result in excess radiation doses to the workers or to the public o RCA Isolation initiated when two-out-of-three or more signals active High RVZ1 supercell exhaust ventilation radiation (PVVS hot cell) o Protects against hot cell equipment leakage or an accident that could potentially result in excess radiation doses to the workers or to the public o Supercell Isolation (area 1) and VTS Safety Actuation initiated when two-out-of-three or more signals active High RVZ1 supercell exhaust ventilation radiation (MEPS extraction hot cells) o Protect against hot cell equipment leakage or an accident that could potentially result in excess radiation doses to the workers or to the public o Supercell Isolation (affected area), MEPS Heating Loop Isolation, and VTS Safety Actuation initiated when one-out-of-two or more signals active
© SHINE Technologies, LLC 30
ESFAS Monitored Variables and Response EXHAUST RADIATION High RVZ1 supercell exhaust ventilation radiation (IXP hot cell) o Protects against hot cell equipment leakage or an accident that could potentially result in excess radiation doses to the workers or to the public o Supercell Isolation (area 10) and VTS Safety Actuation initiated when one-out-of-two or more signals active High RVZ1 supercell exhaust ventilation radiation (purification and packaging hot cells) o Protect against hot cell equipment leakage or an accident that could potentially result in excess radiation doses to the workers or to the public o Supercell Isolation (affected area) initiated when one-out-of-two or more signals active
© SHINE Technologies, LLC 31
ESFAS Monitored Variables and Response MEPS AND IXP High MEPS heating loop radiation o Protect against leakage of high radiation solutions into the heating water loop, which is partially located outside the supercell shielding and could potentially result in an excess dose to the workers o MEPS Heating Loop Isolation (affected loop) initiated when one-out-of-two or more signals active MEPS area A/B/C three-way valve position indication o Protect against a misalignment of the extraction column upper and lower three-way valves, degrading one of the barriers preventing misdirection of chemical reagents or target solution o Extraction Column Alignment Actuation (affected area) initiated when two-out-of-two signals active IXP three-way valve position indication o Protect against a misalignment of the upper and lower three-way valves, degrading one of the barriers preventing misdirection of chemical reagents or target solution o IXP Alignment Actuation initiated when two-out-of-two signals active
© SHINE Technologies, LLC 32
ESFAS Monitored Variables and Response PVVS, VTS, AND RDS High PVVS carbon delay bed exhaust temperature o Protect against a fire in the PVVS delay beds o Carbon Delay Bed Isolation (affected bed) initiated when one-out-of-two or more signals active Low PVVS flow o Protects against loss of hydrogen mitigation capabilities in the RPF o RPF Nitrogen Purge initiated when two-out-of-three or more signals active VTS vacuum header liquid detection o Protects against an overflow of the vacuum lift tanks to prevent a potential criticality event o VTS Safety Actuation initiated when one-out-of-two or more signals active RDS liquid detection o Detects leakage or overflow from other tanks and piping o VTS Safety Actuation initiated when one-out-of-two or more signals active
© SHINE Technologies, LLC 33
ESFAS Monitored Variables and Response IU CELL AND TPS High TPS IU cell 1/2/3/4/5/6/7/8 target chamber exhaust pressure o Protects against a break in the tritium exhaust lines in the IU cell o TPS Train Isolation (affected train) and RCA Isolation initiated when one-out-of-two or more signals active High TPS IU cell 1/2/3/4/5/6/7/8 target chamber supply pressure o Protects against a break in the tritium supply lines in the IU cell o TPS Train Isolation (affected train) and RCA Isolation initiated when one-out-of-two or more signals active High TPS exhaust to facility stack tritium o Protects against a release of tritium from the TPS glovebox pressure control exhaust and VAC/ITS process vent exhaust into the facility ventilation systems o TPS Process Vent Actuation initiated when two-out-of-three or more signals active High TPS Confinement Tritium o Protect against a release of tritium from TPS equipment into the associated TPS glovebox o TPS Train Isolation (affected train) and RCA Isolation initiated when one-out-of-two or more signals active
© SHINE Technologies, LLC 34
ESFAS Monitored Variables and Response ADDITIONAL VARIABLES TRPS IU cell 1/2/3/4/5/6/7/8 nitrogen purge o Protects against a loss of hydrogen mitigation capabilities in the IUs o IU Cell Nitrogen Purge initiated upon receipt of discrete signal from TRPS TSPS dissolution tank 1/2 level o Protect against a criticality event due to excess fissile material in a non-favorable geometry system o Dissolution Tank Isolation initiated when one-out-of-two or more signals active UPSS loss of external power o Protects against an anticipatory loss of hydrogen mitigation in the IU cell (i.e., loss of TOGS blowers and recombiners after the UPSS runtime of that equipment has been exceeded) o IU Cell Nitrogen Purge initiated when one-out-of-two or more signals active for predetermined amount of time
© SHINE Technologies, LLC 35
Priority Logic The actuation priority logic (APL) is designed to provide priority of safety-related signals over nonsafety-related signals Division A and Division B TRPS/ESFAS priority logic prioritizes inputs as follows:
- 1) Automatic Safety Actuation, Manual Safety Actuation, and
- 2) PICS nonsafety control signals When the enable nonsafety control is not active, the nonsafety-related control signals are ignored If the enable nonsafety control is active, and no automatic safety actuation or manual safety actuation command is present, the nonsafety control signal can control the component
© SHINE Technologies, LLC 36
Communication between TRPS/ESFAS and PICS INFORMATION COMMUNICATED Each division of TRPS and ESFAS transmits monitoring, indication, and diagnostic information to the PICS for display to operators PICS provides mode transition signals to TRPS, when manually initiated by the operator PICS provides valve and damper position indication to TRPS/ESFAS for verification of completion of protective function PICS provides signals to TRPS/ESFAS to reposition components, when manually initiated by the operator and enable nonsafety switch is in the enable position
© SHINE Technologies, LLC 37
Communication between TRPS/ESFAS and PICS METHODS OF COMMUNICATION Communication from the TRPS/ESFAS to the PICS is via serial connection (via MODBUS RTU protocol)
Communication from the PICS to the TRPS/ESFAS is via a series of discrete contacts which communicate a series of addresses that are correlated to inputs and nonsafety control signals All interfacing between the TRPS/ESFAS and the PICS is by the gateway communication module (GWCM)
© SHINE Technologies, LLC 38
Advisory Committee on Reactor Safeguards SHINE Medical Technologies Operating License Application Chapter 7 - Instrumentation and Controls July 19, 2022 - Non-Proprietary Office of Nuclear Reactor Regulation
I&C Technical Review Team
- Dinesh Taneja - Senior Electronics Engineer (HIPS, ESFAS, RMS)
- Norbert Carte - Senior Electronics Engineer (TRPS, NFDS, PICS)
- Duane Hardesty - Sr. Project Manager (Technical Specifications)
- Rossnyev Alvarado - Electronics Engineer 2
Guidance and Acceptance Criteria
- NUREG-1537, Part 1, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Format and Content, issued February 1996;
- NUREG-1537, Part 2, Guidelines for Preparing and Reviewing Applications for the Licensing of Non-Power Reactors, Standard Review Plan and Acceptance Criteria, issued February 1996;
- Final Interim Staff Guidance (ISG) Augmenting NUREG-1537, Part 1 and Part 2, for Licensing Radioisotope Production Facilities and Aqueous Homogeneous Reactors 3
SAFETY EVALUATION OVERVIEW 4
Chapter 7 Safety Evaluation
- Current Scope
- I&C Design Criteria
- Highly integrated Protection System (HIPS)
- Target solution vessel reactivity protection system (TRPS)
- neutron flux detection system (NFDS)
- Engineered safety features actuation system (ESFAS )
- radiation area monitoring system (RMS)
- Under NRC Review
- Lifecycle Development (HIPS, TRPS, & ESFAS)
- Technical Specifications
- PICS 5
I&C Systems 6
Applicable SHINE Facility Design Criteria
- Staff evaluated the I&C design against relevant SHINE Design Criteria
- TRPS: Criteria 1-6, 13-19, 38, 39
- NFDS: Criteria 13-19
- ESFAS: Criteria 1-6, 13-19, 37-39
- RMS: Criteria 13, 38 7
HIPS REVIEW 8
HIPS Design
- HIPS platform is used for SHINE TRPS and ESFAS
- SHINE incorporates by reference HIPS Topical Report (TR)
- SHINE technical report TECRPT-2018-0028 dispositions the HIPS TR ASAIs and explains the TRPS & ESFAS architecture differences from TR
- Consistent with HIPS TR, TRPS & ESFAS design incorporates the fundamental design principles of independence, redundancy, predictability &
repeatability, and diversity & defense-in-depth 9
HIPS Design
- Key modifications & additions to HIPS platform for SHINE TRPS & ESFAS applications:
- Remote input submodule (RISM)
- Implementation of communication modules (CM)
- Scheduling, bypass, and voting modules (SBVM)
- Gateway Communications modules (GWCM)
- Hardwired module (HWM) input routing
- Implementation of equipment interface module (EIM) outputs
- HIPS platform Self-testing features 10
HIPS Design 11
HIPS Design
- HIPS platform equipment qualification (EQ)
- Mild environmental qualification performed per IEEE Std. 623-2003
- 140°F for continuous operations
- 158°F for limited operations
- Seismic qualification per IEEE Std. 344-2013
- EMI/RFI qualification per RG 1.180
- HIPS equipment grounding per IEEE Std. 1050-2004 12
HIPS Operations
- Three separate and independent divisions consisting primarily SFMs, SBMs, SBVMs, and EIMs
- Each division based on different FPGA technology
- Each division uses TMR architecture
- Three Safety Data Buses (SDB1-SDB3)
- Three SBVM or SBM
- Each EIM receives three voted inputs
- One-way interdivision communications
- One-way data communication to PICS via M&I CM 13
HIPS Operations
- TRPS and ESFAS architecture incorporates following fundamental design principals:
- Independence
- Redundancy
- Predictability and Repeatability
- Diversity
- Additional TRPS and ESFAS design attributes:
- Access control
- Prioritization of functions
- Completion of protective functions 14
Gateway Communications Architecture 15
HIPS Operations
- Diagnostics and self-testing
- Operational and maintenance bypass
- Manual Actuations
- Response Times/ Analytical Limits / Setpoints 16
Staff Evaluation of SHINEs HIPS Equipment The NRC staff has reasonable assurance that the HIPS digital I&C platform used to implement TRPS and ESFAS is designed to be consistent with the approved HIPS TR and incorporates the fundamental design principals of independence, redundancy, predictably and repeatability, and diversity.
The NRC staff also finds that the HIPS design meets the applicable portions of the SHINE Design Criteria 15, 16, and 19.
Therefore, the NRC staff concludes that the HIPS platform used to implement TRPS and ESFAS is capable of performing the allocated design basis safety function under postulated conditions.
17
TRPS REVIEW 18
TRPS / NFDS Design
- Design Criteria - Performance Objectives
- Provide criterion for achieving reasonable assurance of adequate safety
- Some are more safety significant than others
- Design Bases - Functions and Values
- Events Described in other FSAR Chapters
- Analysis Demonstrates the DB achieves the DC
- Variables Monitored & Functions Actuated
- Setpoints and Response Times (Analytic Values) 19
TRPS Design 20
TRPS Design 21
TRPS - SHINE Design Criteria
- Protect Solution Design Limits - for AOOs
- Functions Support other FSAR Chapters
- Single Failure Criteria
- redundancy & independence
- supports maintenance and testing
- Control of Access (HIPS Equipment Features)
- Independence from PICS 22
TRPS - Design Bases
- Safety Functions - FSAR 7.4.3.1 / 7.8.3.1
- IU Cell Safety Actuation
- IU Cell Nitrogen Purge
- IU Cell Tritium Purification System (TPS) Actuation
- Driver Dropout
- Analytic Values - See FSAR Table 7.4-1
- Range, Accuracy, Analytic Limits, & Response Times 23
TRPS - Design Bases
- Safety Functions - FSAR 7.4.3.1
- FSAR 7.4.3.1.x References Specific Ch 13 Scenarios
- Variables Monitored: FSAR 7.4.4.1.x
- References Specific Ch 13 Scenarios
- Equipment Actuated: FSAR 7.4.3.1.x
- Analytic Values - See Table 7.4-1
- Range, Accuracy, Setpoints, & Response Times
- Operation & Design Criteria 24
Staff Evaluation of SHINEs TRPS & NFDS The NRC staff has reasonable assurance that the SHINE TRPS is designed to 1) mitigate the consequences of design basis events within the main production facility, 2) provides sense, command, and execute functions necessary to maintain the facility confinement strategy, 3) provides process actuation functions required to shut down processes and maintain processes in a safe condition, and provides system status and measured process variable values to the facility process integrated control system (PICS) for viewing, recording, and trending.
The NRC staff has reasonable assurance that the NFDS is adequately described in SHINE FSAR Section 7.8. The NFDS is adequately designed for measurement of the neutron flux signal, signal processing, indication, and interfacing with other systems, including providing analog input to the TRPS.
The NRC staff also finds that the TRPS design meets SHINE design criteria 1 through 6, 13 through 19, and 37 through 38. The staff review of the lifecycle development process for HIPS is described in Section 7.4.2 of this SER and the adequacy of HIPS and TRPS-related TS is evaluated in Section 7.4.10 of this SER. Therefore, the NRC staff concludes that the TRPS is capable of performing the allocated design basis safety function under postulated conditions.
25
ESFAS REVIEW 26
ESFAS / RMS Design
- ESFAS monitors process variables for confinement of fission products and tritium, and for criticality safety
- Safety-related process radiation monitors (part of RMS) provide analog signals to the ESFAS and TRPS used to generate actuation signals
- ESFAS also provides system status and process variable values to the PICS for viewing, recording, and trending 27
ESFAS Architecture 28
ESFAS / RMS Design
- SHINE Design Criteria 1 through 6, 13 through 19, and 37 through 39 apply to the ESFAS
- SHINE Design Criteria 1, 2, 4, 13 and 38 apply to safety-related process radiation monitors
- Key ESFAS Design Features:
- Sharing of Structures, Systems, and Components
- ESFAS does not share components between irradiation units and meets SHINE Design Criterion 5
- Instrumentation and Controls
- Process variables listed in FSAR Table 7.5-1 are used for display and to initiate defined actuation of the applicable engineered safety features.
ESFAS has operable protection capability in all operating modes, anticipated transients, and postulated accidents and meets SHINE Design Criterion 13 29
ESFAS / RMS Design
- Protective System Functions
- ESFAS is designed to perform the safety functions for transients and accidents credited in FSAR Chapter 13 to maintain the facility confinement strategy, provide process shut down functions and maintain processes in a safe condition, and meets the SHINE Design Criterion 14
- Protection System Failure Modes
- ESFAS is designed to fail into a safe state and perform its protective actions upon loss of power, loss of an ESFAS component, or adverse environmental conditions, and meets the SHINE Design Criterion 17
- Separation of Protection and Control Systems
- ESFAS is adequately separated from the PICS such that failure of any single PICS component leaves intact a system satisfying all reliability, redundancy, and independence requirements of the ESFAS, and meets SHINE Design Criterion 18 30
ESFAS / RMS Design
- Protection Against Anticipated Transients
- ESFAS is designed to ensure an extremely high probability of accomplishing its safety functions in the event of anticipated transients, and meets the SHINE Design Criterion 19
- Criticality Control in the Radioisotope Production Facility
- To satisfy the double contingency principle (DCP) required by the SHINE criticality safety program, ESFAS is designed to provide two active engineered criticality safety controls, namely; vacuum transfer system (VTS) actuation and TSPS dissolution tank isolation, and meets the SHINE Design Criterion 37
- Monitoring Radioactivity Releases
- ESFAS is designed to monitor primary confinement boundary, hot cell, and glovebox atmospheres to detect potential leakage of gaseous or other airborne radioactive material that may be released from normal operations, including anticipated transients and from postulated accidents, and meets the SHINE Design Criterion 38 31
ESFAS / RMS Design
- Hydrogen Mitigation
- ESFAS is designed to initiate nitrogen purge to control the buildup of hydrogen that is released into the primary system boundary and tanks or other volumes that contain fission products and produce significant quantities of hydrogen to ensure that the integrity of the system and confinement boundaries is maintained, and meets the SHINE Design Criterion 39
- Single Failure
- ESFAS is designed to actuate only Division A component for select safety functions where a passive check valve is credited as a redundant component. In each instance, sufficient redundancy is provided such that no single failure results in the loss of the protective function.
32
Staff Evaluation of SHINEs ESFAS & RMS
- SHINE ESFAS & RMS are designed to:
- 1) Mitigate the consequences of design basis events within the main production facility
- 2) Provides sense, command, and execute functions necessary to maintain the facility confinement strategy
- 3) provides process actuation functions required to shut down processes and maintain processes in a safe condition and provides system status and measured process variable values to PICS for viewing, recording, and trending.
- ESFAS design meets SHINE design criteria 1 through 6, 13 through 19, and 37 through 39
- Safety-related process radiation monitors meets SHINE Design Criteria 1, 2, 4, 13, and 38
- ESFAS & RMS are capable of performing the allocated design basis safety function under postulated conditions 33
Questions 34
Acronyms APL actuation and priority logic (see HIPS TR)
ASAI application specific action item (see HIPS TR)
BF3 boron trifluoride BIST built-in self-test (see HIPS TR)
CAAS criticality accident alarm system CAMS continuous air monitoring system CCF common cause failure CDA critical digital asset CM communication modules (a HIPS module)
COTS commercial off-the-shelf CTB calibration and test bus (see HIPS TR)
EIM equipment interface module (a HIPS module)
EMI electromagnetic interference 35
Acronyms ESFAS engineered safety features actuation system FAT factory acceptance test FCR facility control room FDCS facility data and communications system FPGA field programmable gate array (see HIPS TR)
HIPS highly integrated protection system (see HIPS TR)
HVPS high voltage power supply HW-SM hardwired submodule (a HIPS module)
HWM hardwired module (a HIPS module)
I&C instrumentation and control IEEE Institute of Electrical and Electronic Engineers IF irradiation facility 36
Acronyms ISG interim staff guidance ISM input submodule (a HIPS module)
IU irradiation unit MI-CM monitoring and indication communication module (see HIPS TR)
MIB monitoring and indication bus (see HIPS TR)
MWS maintenance workstation (see HIPS TR)
NDAS neutron driver assembly system NFDS neutron flux detection system NPSS normal electrical power supply system NVM nonvolatile memory (see HIPS TR)
OOS out of service(see HIPS TR)
PDC Principal Design Criteria PICS process integrated control system 37
Acronyms PLDS programmable logic design specification PLRS programmable logic requirements specification QA quality assurance RAMS radiation area monitoring system RCA radiologically controlled area RDS radioactive drain system RFI radio-frequency interference RISM remote input submodule (a HIPS module)
RVZ1 radiological ventilation zone 1 RVZ1e radiological ventilation zone 1 exhaust subsystem RVZ1r radiological ventilation zone 1 recirculating subsystem RX receiver (Figure 7.1-x)
SASS subcritical assembly support structure SBM scheduling and bypass modules (a HIPS module) 38
Acronyms SBVM scheduling, bypass, and voting modules (a HIPS module)
SCAS subcritical assembly system SDB1 safety data bus 1 (see HIPS TR)
SDB2 safety data bus 2 (see HIPS TR)
SDB3 safety data bus 3 (see HIPS TR)
SDE secure development environment (see HIPS TR)
SFM safety function module (a HIPS module)
SOV solenoid operated valve SR safety-related SRM stack release monitor SRMS stack release monitoring system SVM scheduling and voting module (a HIPS module)
SyRS system requirements specification 39
Acronyms TMR triple modular redundant TOGS TSV off-gas system TPS tritium purification system TR topical report TRPS target solution vessel reactivity protection system TSPS target solution preparation system TSSS target solution storage system TSV target solution vessel TX transmitter (Figure 7.1-x)
UPSS uninterruptible electrical power supply system V&V verification & validation VTS vacuum transfer system 40
BACKGROUND 41
Setpoints
- Setpoints established to protect Analytical Limits
- Derived from Analytic Limits in Safety Analysis (Tables 7.4-1 & 7.5-1)
- Incorporates margin and assumed uncertainties in sensors & instrumentation
- Setpoint Methodology Described in FSAR (under audit)
- Provided in Technical Specifications & LSSSs/LCOs
- Most limiting Values in TS LCOs (under review) 42
Background Information 43
Background Information 44
Lifecycle Process (under review) 45
PICS (Under Review) 46
Background Information - Main Control Board 47